Anyone have any luck creating an event handler to trigger when an FTP session is initiated from an internal interface heading outbound and triggering an email? I tried a DLP sensor, but it will not work here as most of the FTP transfers are initiated on port 21 but swap to 990 (tls).
