Is it possible to block only FTP "put" commands so it does not allow users to upload files? We want to allow users to "get" files via FTP though the proxies just not send files?
Connection.Protocol equals "FTP AND
Command.Name equals "PUT"
Should do the trick
Command name could vary, rule trace would show for certain. The command may be "STOR" as well.