Event Channels is the operational event routing system in Files.com. When something happens on your site, for example a Sync completing, an Automation failing, a user being locked out, or an Expectation deadline being missed, Files.com produces an Event Record. Event Channels routes those records to external destinations including a Slack channel, a webhook endpoint, or an SNS topic.

Use Event Channels when the people or systems responsible for a workflow need its outcome delivered to them. Administrators can direct the relevant events to each team, and integration developers can use those events to start downstream work. Separating event selection from delivery destinations lets the same operational signal serve several recipients without making each recipient monitor the site independently.

How Event Channels Work

Events are the records produced when something happens on your site. Each carries a type, timestamp, severity, title, and summary. Event records exist whether or not any subscription matched them.

Channels are named groupings of subscriptions. One channel per workspace can be marked as the default. Subscriptions created without specifying a channel attach to the default.

Subscriptions are attached to a channel and define which events are delivered to which targets. A subscription specifies event types to match, an optional filter, and one or more targets.

Targets are the delivery destinations: an email address list, a webhook URL, a Slack webhook, a Teams webhook, an SNS topic, a Pub/Sub topic, or a folder you stream matched events to. A target can be reused across multiple subscriptions.

Delivery Attempts are the per-target delivery records created when a subscription matches an event. Each tracks the outcome, HTTP response, and retry state for that delivery.

Event Selection and Delivery

For a failed nightly Sync, a subscription can match Sync: Failure and send the record to the responsible team's Slack target. The Delivery Attempt records whether Slack accepted the message. That result confirms delivery to the target, rather than that someone read the alert or repaired the Sync.

For an Automation completion, a subscription can match Automation: Success and publish to an SNS target. The receiving application decides how to process the signal; a successful publish does not confirm completion of its job. A Folder target can instead write matched events for a system that reads files on its own schedule, without an inbound webhook receiver.

The same relationship applies to Expectation deadlines or user lockouts: select the event, choose who or what receives it, and review delivery separately from the response. An alert does not itself pause downstream processing.

Event Channels overlaps with a few other Files.com features. Here's how to tell them apart.

Event Channels vs. Notifications

Notifications cover file and folder activity: uploads, downloads, moves, copies, and deletions. They are configured per folder.

Event Channels cover operational events: Sync and Automation run outcomes, Expectation evaluations and incidents, SSO and LDAP activity, user lockouts, pending work failures, SIEM delivery results, and client log uploads.

Use Notifications when the trigger is file or folder activity.

Use Event Channels when the trigger is a platform or system event.

Event Channels vs. Admin Email Preferences

Site Administrators have per-user email preferences that send failure alert emails for Sync failures, Automation failures, SSO issues, user security events, and others. These are configured in each user's account settings and use exponential backoff batching starting at 3 hours, capping at 24 hours.

Admin email preferences are separate from Event Channel configuration. Changing an email preference does not create or modify any Event Channel, Target, or Subscription.

Use admin email preferences for personal failure alerts.

Use Event Channels when you need delivery to teams, external systems, or non-admin recipients, or when you need per-event delivery, configurable batching, filtering, or a delivery audit trail.

Event Channels vs. Logs and Reports

Logs and Reports record what happened and are available for investigation and historical review. They require someone to check them.

Use Logs and Reports for investigation and audit.

Use Event Channels when an event requires immediate notification.

Event Channels vs. Automations

Automations trigger actions inside Files.com: move, copy, rename, delete, or process files. Event Channels notify external systems when something happens.

The two work together. An Automation can process a file on arrival. An Event Channel can notify an external system that processing completed. Use Automations to perform the file workflow and Event Channels to route its operational outcome. Automations can also deliver files or call external systems as part of that workflow.

Event Channels vs. SIEM Integrations

Files.com delivers audit and activity logs through two methods: direct SIEM integrations and Log File Streaming. Direct SIEM integrations stream logs to SIEM platforms so the logs can be correlated with other security and infrastructure data for monitoring, alerting, and investigation workflows. Log File Streaming writes logs to files in a folder on your site for file-based access, scheduled processing, and retention.

SIEM integrations are used for monitoring, compliance, reviewing past activity, and long-term log retention.

Event Channels are used for real-time alerting on specific events, including SSO failures, user lockouts, or LDAP login attempts, routed to a webhook, Slack, Teams, SNS, or Pub/Sub target.

Event Channels also monitor SIEM integration itself: if a SIEM delivery fails, an event is produced and can be routed to notify your team immediately.

Folder Targets vs. Log File Streaming

Both stream batched JSON or CSV files to a folder on an interval, so it is easy to assume they are the same thing. The difference is filtering, not the delivery mechanism. Log File Streaming exists to push complete categories of audit and activity logs, the same data a SIEM integration would receive, with no event-level filtering built in. A Folder target reuses the filtering Subscriptions already provide, writing only the specific event types and filter conditions a subscription matched.

Use Log File Streaming when you want broad, complete log categories for archival, analysis, or audit, and can parse out what you care about downstream.

Use a Folder target when you want only specific events, like a particular success or failure condition, delivered as files with no separate parsing step required.