# Audit Watch

Audit Watch is a workflow and compliance feature that monitors key file activity and sends alerts to specific users. Audit Watch Rules are notification policies that can created to monitor uploads and other actions on a file, a set of files, or a folder.

Designated users are notified by email in real time immediately after the activity occurs.  The user who initiated the activity is not notified.

{{ :auditwatch:audit-email.png?nolink&700 |}}

## Creating an Audit Watch Rule

Audit Watch rules can be added or removed through a the **Audit Watch** Tab under **Organization > Shared Team Folders**.

{{ :auditwatch:auditwatch.png?nolink&700 }}

Audit watch rules are added and deleted by Administrators however any user may receive notifications.

Rules are created for specific Shared Team folders or subfolders. Navigate to the Shared Team Folder, or subfolder you wish to create the Audit Watch Rule for. Click the (+) symbol to bring up the New Audit Watch Rule dialog. The default rule will notify all users of upload activity in that folder and its subfolders.

{{ :auditwatch:newauditwatch.png?nolink&300 }}

There are two parts to an Audit Watch rule:

 1. Watch Condition
 2. Notification Action

### Watch Condition

An Audit Watch rule monitors activity in a folder that matches a specific pattern, a regular expression.

{{ :auditwatch:watch-condition.png?nolink&600 |}}

The watch expression is a regular expression in [[https://www.pcre.org/current/doc/html/pcre2syntax.html|PCRE syntax]]. You may match the filename, file extension and/or the metadata file description.

The rule can be activated for subfolders, including folders created in the future, otherwise it will only monitor the folder associated with the rule.
### Notification Action

The rule notifies users when the rule condition matches activity. The notification message can be customized and users selected.

{{ :auditwatch:watch-action.png?nolink&600 |}}

If "Include a download link" is selected a share link will be used and the File Path will appear as a hyperlink. A share link is only created if the user has permissions to read the file and there are no incompatible share policies such as password required or reason for sharing required.

The Notification subject is used as the Email Subject.

The message contents can also be customized with the following template placeholders:

 * !FOLDERNAME! — Shared Team Folder name
 * !FILEDESCRIPTION! — Description of the file
 * !FILEPATH! — full path to file
 * !USER! — Name of user that initiated activity
 * !EVENT! — Event that occurred such as upload or rename
 
The notification may be sent to all, or select users.

{{ :auditwatch:audit-email.png?nolink&600 |}}