Date type = Large file (>500KB)
Source = My organization
Protocol = any
Action = ask user
All other rules are set to detect. User check is enabled and installed on all client machines.

A.
when a user uploads a 600 KB file to his yahoo account via web mail (via his browser), he will
be prompted by user check

B.
When a user sends an e-mail with a small point with a small body and 5 attachments, each of
200 KB to, he will be prompted by user check.

C.
When a user sends an email with an attachment larger than 500 KB to, he will be prompted by
user check.

D.
When a user sends an email with an attachment larger than 500 KB to, he will be prompted by
user check.

Explanation: