Customize applications monitored for file exfiltration

Step 1: Find the numeric OrgID

To view and edit the list of monitored applications, you must first identify the numeric ID of the applicable organization.

1. Sign in to the Code42 console.
2. Select Administration > Organizations > Active.
3. Select an organization:
   • To apply the same values to your entire Code42 environment, select ​​​​your top-level organization. This organization is at the top of the organizational hierarchy and is the parent for all other organizations.
   • To apply different values based on organization, select each organization you want to modify and repeat the steps below for each organization individually.
4. In the web browser's address bar, note the numeric ID in the URL after "organization" but before any query or token parameters. In this example, the OrgID is 123456: https://authority-server.example.com/console/#/organization/123456?t=78910

Step 2: View existing customizations

Use the GET method to view existing custom applications being monitored for file exfiltration. The OrgSetting resource also contains keys for numerous other Code42 settings. Therefore, to view only your customizations, you must include the device_org_winAppActivity_binaryWhitelist or device_org_macAppActivity_binaryWhitelist key as a query parameter.

The example below assumes basic familiarity with curl commands. Use this as a template to create a command specific to your Code42 environment:

Copy to clipboardCopied!

curl -X GET \
  '<request_url>/api/OrgSetting/<OrgID>?keys=device_org_winAppActivity_binaryWhitelist' \
  -H 'cache-control: no-cache' \
  -H 'content-type: application/json' \
  -u 'username'

1. Replace <request_url> with the address of your Code42 environment (do not include the brackets in your request).
2. Replace <OrgID> with the number identified in Step 1 above (do not include the brackets in your request).
3. Replace username with your Code42 username.
4. Execute the curl command in your command-line tool of choice. When prompted, enter your password.
   The Code42 API returns the list of custom applications. If there are no custom applications, the data parameter in the response is empty. 
5. For Mac devices, repeat the steps above using the key device_org_macAppActivity_binaryWhitelist. 

Step 3: Update applications

Use the PUT method to update the existing list of custom applications. Before sending any updates, make sure to complete Step 2 above to obtain the list of customizations.

The steps below assume basic familiarity with curl commands. Use the following example as a template to create a command specific to your Code42 environment:

Copy to clipboardCopied!

curl -X PUT \
  '<request_url>/api/OrgSetting/<OrgID>' \
  -H 'cache-control: no-cache' \
  -H 'content-type: application/json' \
  -u 'username' \
  -d '{ 
    "packets": [
        {
            "key": "device_org_winAppActivity_binaryWhitelist",
            "value": "customProcess.exe,customProcess2.exe",
            "locked": true
        }
    ]
}'

1. Replace <request_url> with the address of your Code42 environment (do not include the brackets in your request).
2. Replace <OrgID> with the number identified in Step 1 above (do not include the brackets in your request).
3. Replace username with your Code42 username. When prompted, enter your password.
4. Edit the list inside the quotation marks  of the value parameter to include the names of the applications you want to monitor.
5. Execute the curl command in your command-line tool of choice.
6. For Mac devices, repeat the steps above using the key device_org_macAppActivity_binaryWhitelist. 
7. To confirm the new settings are applied, re-submit the GET request described in Step 2 above and review the list of custom applications.

Step 1: Find the numeric OrgID

To view and edit the list of monitored applications, you must first identify the numeric ID of the applicable organization.

1. Sign in to the Code42 console.
2. Select Administration > Organizations > Active.
3. Select an organization:
   • To apply the same values to your entire Code42 environment, select ​​​​your top-level organization. This organization is at the top of the organizational hierarchy and is the parent for all other organizations.
   • To apply different values based on organization, select each organization you want to modify and repeat the steps below for each organization individually.
4. In the web browser's address bar, note the numeric ID at the end of the URL. In this example, the OrgID is 123456: https://authority-server.example.com:4285/console/#/organization/123456

Step 2: View existing applications

Use the GET method to view existing applications being monitored for file exfiltration. The OrgSetting resource also contains keys for numerous other Code42 settings. Therefore, to view only the applications being monitored, you must include the org_securityTools_win_binary_whitelist or org_securityTools_mac_binary_whitelist key as a query parameter.

The example below assumes basic familiarity with curl commands. Use this as a template to create a command specific to your Code42 environment:

Copy to clipboardCopied!

curl -X GET \
  '<request_url>/api/OrgSetting/<OrgID>?keys=org_securityTools_win_binary_whitelist' \
  -H 'cache-control: no-cache' \
  -H 'content-type: application/json' \
  -u 'username'

1. Replace <request_url> with the address of your Code42 environment (do not include the brackets in your request).
2. Replace <OrgID> with the number identified in Step 1 above (do not include the brackets in your request).
3. Replace username with your Code42 username.
4. Execute the curl command in your command-line tool of choice. When prompted, enter your password.
   The Code42 API returns the list of monitored applications.
5. For Mac devices, repeat the steps above using the key org_securityTools_mac_binary_whitelist. 

Step 3: Add or remove applications

Use the PUT method to add or remove applications. Before sending any updates, make sure to complete Step 2 above to obtain the list of monitored applications.

The steps below assume basic familiarity with curl commands. Use the following example as a template to create a command specific to your Code42 environment:

Copy to clipboardCopied!

curl -X PUT \
  '<request_url>/api/OrgSetting/<OrgID>' \
  -H 'cache-control: no-cache' \
  -H 'content-type: application/json' \
  -u 'username' \
  -d '{ 
    "packets": [
        {
            "key": "org_securityTools_win_binary_whitelist",
            "value": {
                "binaryFileNames":[
                    chrome.exe,chromium.exe,iexplore.exe,firefox.exe,opera.exe,microsoftedge.exe,microsoftedgecp.exe,runtimebroker.exe,browser_broker.exe,sftp.exe,curl.exe,winscp.exe,scp.exe,filezilla.exe,fzsftp.exe,slack.exe
                ]
            },
            "locked": true
        }
    ]
}'

1. Replace <request_url> with the address of your Code42 environment (do not include the brackets in your request).
2. Replace <OrgID> with the number identified in Step 1 above (do not include the brackets in your request).
3. Replace username with your Code42 username. 
4. Edit the list inside the square brackets of the binaryFileNames value to include only the names of the applications you want to monitor.
5. Execute the curl command in your command-line tool of choice. When prompted, enter your password.
6. For Mac devices, repeat the steps above using the key org_securityTools_mac_binary_whitelist. 
7. To confirm the new settings are applied, re-submit the GET request described in Step 2 above and review the list of monitored applications.