Event Channels is the operational event routing system in Files.com. When something happens on your site, for example a Sync completing, an Automation failing, a user being locked out, or an Expectation deadline being missed, Files.com produces an Event Record. Event Channels routes those records to external destinations including a Slack channel, a webhook endpoint, or an SNS topic.

The system is built around five concepts: Channels organize your routing rules, Targets define where events are sent, Subscriptions define which events go to which targets, Events are the records themselves, and Delivery Attempts track whether each delivery succeeded.

What You Can Do With Event Channels

React to Sync and Automation failures immediately. Subscribe to failure events and route them to a webhook or Slack channel. Your team sees the failure as it happens instead of finding it during the next log review. When you have dozens or hundreds of automations running, Event Channels is the only way to know which one failed without clicking into each individually.

Alert when a file deadline is missed. If you use Expectations to monitor whether files arrive on schedule, subscribe to missing or late evaluation events. When a vendor misses a delivery window, the right team is notified before dependent processing runs on absent data.

Route security events to your SIEM. SSO failures, LDAP login attempts, and user lockouts can be delivered directly to your security platform without requiring anyone to check Files.com logs.

Let each team manage its own subscriptions. A security team can route SSO failures to one destination. An operations team can route Sync failures to another. Each subscription is independent.

Audit every notification. The Delivery Attempts log records whether each delivery was queued, succeeded, retried, or failed, with timestamps, response codes, and response bodies.

Get alerted on GPG job failures and client log upload errors. When a background GPG encryption or decryption job fails, or when a Files Connect or CLI client cannot upload its activity logs, Files.com records a Pending Work or Client Log event. There is no admin email alert for either. Event Channels is the only way to get notified when these failures occur.

Get notified when a Sync or Automation succeeds. Admin email alerts cover failures only. If a downstream system or team needs to know a transfer completed, subscribe to success events and route that signal to a webhook or queue.

How Event Channels Work

Channels are named groupings of subscriptions. One channel per site can be marked as the default; subscriptions created without specifying a channel attach to the default.

Targets are the delivery destinations: an email address list, a webhook URL, a Slack webhook, a Teams webhook, an SNS topic, or a Pub/Sub topic. A target can be reused across multiple subscriptions.

Subscriptions define which events are delivered to which targets. A subscription specifies event types to match, an optional filter, and one or more targets.

Events (also called Event Records) are the records produced when something happens on your site. Each carries a type, timestamp, severity, title, and summary. Event records exist whether or not any subscription matched them.

Delivery Attempts are the per-target delivery records created when a subscription matches an event. Each tracks the outcome, HTTP response, and retry state for that delivery.

Example: A sync run fails at 2am. Files.com creates an Event Record with type Sync: Failure. A subscription in your Operations channel matches that event type and routes it to a Slack Webhook target. A Delivery Attempt is created, the payload is sent to Slack, and your on-call team sees the alert within seconds. The Delivery Attempt log records the HTTP 200 response as confirmation the message was accepted.

Event Channels vs. Other Options

Notifications

Notifications cover file and folder activity: uploads, downloads, moves, copies, and deletions. They are configured per folder.

Event Channels cover operational events: Sync and Automation run outcomes, Expectation evaluations and incidents, SSO and LDAP activity, user lockouts, pending work failures, SIEM delivery results, and client log uploads.

Use Notifications when the trigger is file or folder activity. Use Event Channels when the trigger is a platform or system event.

Admin Email Preferences

Site Administrators have per-user email preferences that send failure alert emails for Sync failures, Automation failures, SSO issues, user security events, and others. These are configured in each user's account settings and use exponential backoff batching starting at 3 hours, capping at 24 hours.

Admin email preferences are separate from Event Channel configuration. Changing an email preference does not create or modify any Event Channel, Target, or Subscription.

Use admin email preferences for personal failure alerts. Use Event Channels when you need delivery to teams, external systems, or non-admin recipients, or when you need per-event delivery, configurable batching, filtering, or a delivery audit trail.

Logs and Reports

Logs and Reports record what happened and are available for investigation and historical review. They require someone to check them.

Use Logs and Reports for investigation and audit. Use Event Channels when an event requires immediate notification.

Automations

Automations trigger actions inside Files.com: move, copy, rename, delete, or process files. Event Channels notify external systems when something happens.

The two work together. An Automation can process a file on arrival; an Event Channel can notify an external system that processing completed. Use Automations when the response stays within Files.com. Use Event Channels when the response is in an external system.

SIEM Integrations

SIEM integrations stream structured log data continuously to your security platform. The integration runs on a schedule and delivers batches of log records for long-term storage, compliance, and historical analysis.

SIEM integrations are used for compliance, forensic investigation, and long-term log retention. Event Channels are used for real-time alerting on specific events, including SSO failures, user lockouts, or LDAP login attempts, routed to a webhook, Slack, Teams, SNS, or Pub/Sub target. Event Channels also monitor SIEM delivery itself: if a SIEM delivery fails, a SIEM event is produced and can be routed to notify your team immediately. Many teams use both: SIEM for the full audit record, Event Channels for immediate notification and delivery monitoring.