Event Channels is the operational event routing system in Files.com. When something happens on your site, for example a Sync completing, an Automation failing, a user being locked out, or an Expectation deadline being missed, Files.com produces an Event Record. Event Channels routes those records to external destinations including a Slack channel, a webhook endpoint, or an SNS topic.

The system is built around five concepts: Channels organize your routing rules, Targets define where events are sent, Subscriptions define which events go to which targets, Events are the records themselves, and Delivery Attempts track whether each delivery succeeded.

What You Can Do With Event Channels

Here are some examples of how Event Channels can be used.

Trigger Downstream Workflows or Hand Off to a Queue

Route any event to an SNS topic, Pub/Sub topic, or webhook to kick off processing in an external system. Use this to signal a Sync or Automation completion to a downstream pipeline, or to publish events to a queue so another system can consume them on its own schedule. Admin email alerts cover failures only, so Event Channels is the only way to signal completions to external systems automatically.

React to Sync and Automation Failures Immediately

Subscribe to failure events and route them to a webhook or Slack channel. Your team sees the failure as it happens instead of finding it during the next log review. When you have dozens or hundreds of automations running, Event Channels is the only way to know which one failed without clicking into each individually.

Alert When a File Deadline Is Missed

If you use Expectations to monitor whether files arrive on schedule, subscribe to missing or late evaluation events. When a vendor misses a delivery window, the right team is notified before dependent processing runs on absent data.

Get Alerted on Security Events in Real Time

SSO failures, LDAP login attempts, and user lockouts produce events that can be routed to a webhook, Slack, Teams, or any other target. Your security team sees the alert as it happens without anyone needing to check Files.com logs.

How Event Channels Work

Events are the records produced when something happens on your site. Each carries a type, timestamp, severity, title, and summary. Event records exist whether or not any subscription matched them.

Channels are named groupings of subscriptions. One channel per workspace can be marked as the default. Subscriptions created without specifying a channel attach to the default.

Subscriptions are attached to a channel and define which events are delivered to which targets. A subscription specifies event types to match, an optional filter, and one or more targets.

Targets are the delivery destinations: an email address list, a webhook URL, a Slack webhook, a Teams webhook, an SNS topic, or a Pub/Sub topic. A target can be reused across multiple subscriptions.

Delivery Attempts are the per-target delivery records created when a subscription matches an event. Each tracks the outcome, HTTP response, and retry state for that delivery.

Example Use Case: Alerting

A nightly Sync fails at 2am. Files.com creates an Event with type Sync: Failure. A subscription on your channel matches that event type and routes it to a Slack Webhook target. A Delivery Attempt is created, the payload is sent to Slack, and your on-call team is notified immediately. The Delivery Attempt log records the HTTP 200 response as confirmation the message was accepted.

Example Use Case: Downstream Workflow

An Automation completes successfully. Files.com creates an Event with type Automation: Success. A subscription on your channel matches that event and routes it to an Amazon SNS target. A Delivery Attempt is created, the payload is published to the SNS topic, and your downstream processing pipeline receives the signal and begins transforming the files. The Delivery Attempt log confirms the publish succeeded.

Event Channels vs. Notifications

Notifications cover file and folder activity: uploads, downloads, moves, copies, and deletions. They are configured per folder.

Event Channels cover operational events: Sync and Automation run outcomes, Expectation evaluations and incidents, SSO and LDAP activity, user lockouts, pending work failures, SIEM delivery results, and client log uploads.

Use Notifications when the trigger is file or folder activity.

Use Event Channels when the trigger is a platform or system event.

Event Channels vs. Admin Email Preferences

Site Administrators have per-user email preferences that send failure alert emails for Sync failures, Automation failures, SSO issues, user security events, and others. These are configured in each user's account settings and use exponential backoff batching starting at 3 hours, capping at 24 hours.

Admin email preferences are separate from Event Channel configuration. Changing an email preference does not create or modify any Event Channel, Target, or Subscription.

Use admin email preferences for personal failure alerts.

Use Event Channels when you need delivery to teams, external systems, or non-admin recipients, or when you need per-event delivery, configurable batching, filtering, or a delivery audit trail.

Event Channels vs. Logs and Reports

Logs and Reports record what happened and are available for investigation and historical review. They require someone to check them.

Use Logs and Reports for investigation and audit.

Use Event Channels when an event requires immediate notification.

Event Channels vs. Automations

Automations trigger actions inside Files.com: move, copy, rename, delete, or process files. Event Channels notify external systems when something happens.

The two work together. An Automation can process a file on arrival; an Event Channel can notify an external system that processing completed. Use Automations when the response stays within Files.com. Use Event Channels when the response is in an external system.

Event Channels vs. SIEM Integrations

Files.com delivers audit and activity logs through two methods: direct SIEM integrations and Log File Streaming. Direct SIEM integrations stream logs to SIEM platforms so the logs can be correlated with other security and infrastructure data for monitoring, alerting, and investigation workflows. Log File Streaming writes logs to files in a folder on your site for file-based access, scheduled processing, and retention.

SIEM integrations are used for monitoring, compliance, forensic investigation, and long-term log retention.

Event Channels are used for real-time alerting on specific events, including SSO failures, user lockouts, or LDAP login attempts, routed to a webhook, Slack, Teams, SNS, or Pub/Sub target.

Event Channels also monitor SIEM integration itself: if a SIEM delivery fails, an event is produced and can be routed to notify your team immediately.