File Sight Extension Lists

Starting with version 10.0, File Sight now has 3 extension lists on the top File Types tab:

• File Types to Monitor - This list of extensions has always existed, and defaults to * meaning monitor all file types.

  ---

• Allowed File Types - This is new. Any file I/O seen with extensions that are NOT in this list will be flagged with **Not Allowed**.
  
  This list of file extensions can be defined directly in the monitor, or it can refer to a shared list (the Allowed_Extensions list).
  
  

  Note the green box around this list which indicates it can fire alerts. If you get alerts with **Not Allowed** next to the filename, it is coming from this list.

  You can disable this list by setting it to "Use the extensions shown below", and emptying the list. This is the default state.

  

  You can fill the list using the buttons on the right, and also by making manual edits to the list.

  ---

• Ransomware File Types - This is new. Any file I/O seen with extensions that are in this list will be flagged with **Malware**.
  
  This list of file extensions can also be defined directly in the monitor, or it can refer to a shared list (the Ransomware_Extensions list).
  
  

  Note the green box around this list which indicates it can fire alerts. If you get alerts with **Malware** next to the filename, it is coming from this list.

  You can disable this list by setting it to "Use the extensions shown below", and emptying the list. This is the default state.

  

  You can fill the list using the buttons on the right, and also by making manual edits to the list.

  ---

Both of the mentioned shared lists are in the Trusted Services section of the application.