Print support for file types

What is a one sentence summary of your feature request?

Print detections support for file types

Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.

As an incident responder, I need visibility when specific file type are printed, regardless of content.

How do you currently solve the challenges you have by not having this feature?

The current suggestion is to add a broad regex pattern that will detect on any character that would be in a document and flag on that.

Hi Bree,

You’ve identified a real gap. Printers are already a supported exit point in CAP policies, but file type filtering is explicitly not applied to print events — the current architecture keeps the two features separate, which is exactly why the regex workaround was suggested and why it falls short.

The regex approach is not an ideal substitute: it matches on filename patterns globally across all exit points rather than specifically at print time, plus it can’t perform true file type detection by content the way the native file type filter does.

We’ve noted this as a feature gap — enabling file type filtering specifically for the Printers exit point — and will consider it as part of future improvements to CAP policy configuration.

Thanks for flagging it clearly.

If the goal is to just get visibility when specific file types are printed regardless of the content, you can enable the File Tracing feature. This will log every print job under Reports and Analysis → File Tracing, then you can filter by file type. Here’s an example of how these events look like:

This is a Windows only feature at the moment. Would it meet your needs it we could make this work the same way on Macs?