FILE CONTENT ANALYSIS AND DATA MANAGEMENT

1 . A method comprising:

detecting a user activity associated with a file change of a first file;

invoking a plurality of analyzers to scan content of the first file, the plurality of analyzers including a first analyzer;

matching the first analyzer with a first sensitive data item in the first file;

identifying a first policy from a plurality of policies based on a first pre-determined set of analyzers that includes the first analyzer; and

causing display of a first notification in a user interface of a client device, the first notification including a first indication that the first policy may be violated based on the file change associated with the first file.

2 . The method of claim 1 , detecting the user activity associated with the file change of the first file, further comprising:

identifying a list of files that includes the first file to receive event logs generated by a third-party file access control service;

receiving a report that includes the event logs associated with each file in the list of files, the event logs including a first event log associated with the user activity, the first event log including identity data of a customer who has accessed the first file, a timestamp of the first event log, and activity data associated with whether the customer has edited or created the first file; and

causing display of the first notification to further include indications of the identity data of the customer, the timestamp of the first event log, and the activity data.

3 . The method of claim 2 , wherein the customer is managed by a client associated with the client device.

4 . The method of claim 1 , detecting the user activity associated with the file change of the first file, further comprising:

detecting the user activity by intervening an operating system call associated with the first file using a kernel driver;

receiving a first event log associated with the user activity, the first event log including identity data of a customer who has accessed the first file, a timestamp of the first event log, and activity data associated with whether the customer has edited or created the first file; and

causing display of the first notification to further include indications of the identity data of the customer, the timestamp of the first event log, and the activity data.

5 . The method of claim 1 , wherein the plurality of analyzers is implemented in a computing environment of a customer associated with the user activity.

6 . The method of claim 1 , further comprising:

updating the plurality of analyzers based on an indication of user selection from the client device; and

periodically updating the plurality of policies based on a recent change of an industrial regulation.

7 . The method of claim 1 , wherein each analyzer in the plurality of analyzers is generated for a specific type of sensitive data item that is customized to a particular customer.

8 . The method of claim 1 , further comprising:

matching a second analyzer with a second sensitive data item in the first file:

identifying a second policy that corresponds to a second pre-determined set of analyzers that includes the first analyzer and the second analyzer; and

causing display of the first notification in the user interface of the client device to further include a second indication that the second policy may be violated based on the file change associated with the first file.

9 . The method of claim 8 , wherein the first sensitive data item is a social security number and the second sensitive data item is a driver license number.

10 . The method of claim 1 , wherein the user activity is detected in real-time using a kernel driver.

11 . A system comprising:

one or more processors; and

a non-transitory computer-readable storage medium comprising instructions that when executed by the one or more processors cause the one or more processors to perform operations comprising:

detecting a user activity associated with a file change of a first file;

invoking a plurality of analyzers to scan content of the first file, the plurality of analyzers including a first analyzer;

matching the first analyzer with a first sensitive data item in the first file;

identifying a first policy from a plurality of policies based on a first pre-determined set of analyzers that includes the first analyzer; and

causing display of a first notification in a user interface of a client device, the first notification including a first indication that the first policy may be violated based on the file change associated with the first file.

12 . The system of claim 11 , wherein the one or more processors further perform operations of detecting the user activity associated with the file change of the first file comprising:

identifying a list of files that includes the first file to receive event logs generated by a third-party file access control service;

receiving a report that includes the event logs associated with each file in the list of files, the event logs including a first event log associated with the user activity, the first event log including identity data of a customer who has accessed the first file, a timestamp of the first event log, and activity data associated with whether the customer has edited or created the first file; and

causing display of the first notification to further include indications of the identity data of the customer, the timestamp of the first event log, and the activity data.

13 . The system of claim 12 , wherein the customer is managed by a client associated with the client device.

14 . The system of claim 11 , wherein the one or more processors further perform operations of detecting the user activity associated with the file change of the first file comprising:

detecting the user activity by intervening an operating system call associated with the first file using a kernel driver;

receiving a first event log associated with the user activity, the first event log including identity data of a customer who has accessed the first file, a timestamp of the first event log, and activity data associated with whether the customer has edited or created the first file; and

causing display of the first notification to further include indications of the identity data of the customer, the timestamp of the first event log, and the activity data.

15 . The system of claim 11 , wherein the plurality of analyzers is implemented in a computing environment of a customer associated with the user activity.

16 . The system of claim 11 , wherein the one or more processors further perform operations comprising:

updating the plurality of analyzers based on an indication of user selection from the client device; and

periodically updating the plurality of policies based on a recent change of an industrial regulation.

17 . The system of claim 11 , wherein each analyzer in the plurality of analyzers is generated for a specific type of sensitive data item that is customized to a particular customer.

18 . The system of claim 11 , wherein the one or more processors further perform operations comprising:

matching a second analyzer with a second sensitive data item in the first file;

identifying a second policy that corresponds to a second pre-determined set of analyzers that includes the first analyzer and the second analyzer; and

causing display of the first notification in the user interface of the client device to further include a second indication that the second policy may be violated based on the file change associated with the first file.

19 . The system of claim 18 , wherein the first sensitive data item is a social security number and the second sensitive data item is a driver license number.

20 . A machine-readable non-transitory storage medium having instruction data executable by a machine to cause the machine to perform operations comprising:

detecting a user activity associated with a file change of a first file;

invoking a plurality of analyzers to scan content of the first file, the plurality of analyzers including a first analyzer;

matching the first analyzer with a first sensitive data item in the first file;

identifying a first policy based on a first pre-determined set of analyzers that includes the first analyzer; and

causing display of a first notification in a user interface of a client device, the first notification including a first indication that the first policy may be violated based on the file change associated with the first file.