From testing I can see that data going to an FTP server is being monitored. This is done with put or STOR commands. But I don't seem to be able to monitor data that is coming from an FTP server with get or RETR commands.
Is there a way to monitor FTP data transfers from and FTP server?
Data is transfered to an FTP server is done by the raw command STOR or the de-facto client alias put.
Data transfered from an FTP server is done by the raw comamnd RETR or the de-facto client alias put.
Details are in RFC 959.
The Data Loss Prevention (DLP) product monitors STOR transfers only by default. RETR transfers can be monitored by making the following change: