Skip to main content
Code42 Support

Endpoint monitoring

Available in:

StandardPremiumEnterprise
Small Business
Applies to:

Overview

Endpoint monitoring uses the Code42 app to capture file activity on each device in real time, helping you identify five types of potential data leaks or security problems:

  • Removable media
  • Personal cloud
  • Browser activity
  • Restore
  • Pattern matching

Endpoint monitoring identifies most file activity anywhere on a user's device, not just within the user's backup file selection. Pattern matching, however, only applies to files included in the user's backup file selection.

Considerations

If Compliance Settings have been activated for an organization, you cannot enable endpoint monitoring for the organization or child organizations that inherit settings. Parent and sibling organizations are not affected.

Endpoint monitoring types

Endpoint monitoring identifies five types of security-related activity on users' devices.

Endpoint Monitoring Type What Activity Is Identified Example
Removable media Users placing files on removable media, such as USB drives or SD cards. A user plugs in a USB drive, copies a file to the drive, and removes the drive.
Personal cloud

Users syncing files using these cloud storage apps:

A user uploads a file to the Google Drive desktop app.

 

Browser activity
(version 6.5 and later)

 

File upload
(versions 6.0.x)

Users opening files in web browsers, such as attaching to a web-based email.

(Windows device only)

 

A user attaches a file to a Gmail message.
Restore

File restores:

  • Users restoring files, including files belonging to other users.
  • Administrators performing a push restore of files to a user.
A user restores files from the Code42 app.
Pattern matching Existence of known malicious files or patterns of sensitive data based on YARA rules for text (non-binary) files included in the user's backup file selection. A user saves a text file that contains Social Security numbers.
Google Drive permissions requirements
Windows devices may require administrator action to monitor activity in the Google Drive folder:
  • Code42 app version 6.5.0 and earlier: You must grant read access to SYSTEM for the Google Drive folder on each device because, by default, Google Drive grants read access to the logged-in user only, and the Code42 service runs as a system process.
  • Code42 app version 6.5.1 and later: If the Code42 app is installed by a member of the administrator's group, no action is required. If the Code42 app is not installed by a member of administrator's group, you must grant read access to SYSTEM for the Google Drive folder on each device.
See the Microsoft support site for how to add read access to a folder.
Google Drive File Stream considerations
Google's Drive File Stream retrieves files by mounting a temporary drive on the user's device and streaming files to the temporary drive. As a result, Code42 endpoint monitoring detects this activity as a removable media event, not a cloud service event.

Before you begin

Ensure your Code42 environment meets all the requirements for endpoint monitoring:

Component Or Configuration Requirements
Licensing You must have a product plan that includes a Code42 Security Center license in order to use endpoint monitoring.
Authority server

Meets the minimum system requirements

Storage server
Code42 app
  • All Code42 apps must meet these version requirements before following the steps below to enable endpoint monitoring:
    • 6.x Code42 apps: all versions
    • 5.x Code42 apps: 5.1.2 or later
    • 4.x Code42 apps: 4.5.2 or later
  • Operating system:
    • Windows
    • Mac
  • Installed for all users
    Per-user installations are not supported.
Backup encryption key policy Users' archives must use the Standard archive encryption key policy.
Archive key password and Custom key are not supported.
Code42 app for Splunk (Optional)

With a subscription (or trial) for Splunk Enterprise, you can view the data collected by endpoint monitoring using version 2.1 or later of the Code42 app for Splunk.

Enable endpoint monitoring

Step 1: Lock archive encryption key settings

Endpoint monitoring requires standard encryption. Before implementing endpoint monitoring in any organization in your Code42 environment, you must lock the encryption setting at its standard level. Locking this setting prevents users or administrators from changing the setting.

Disabled inheritance
If you disable inheritance for an organization, that organization is not affected by changes to its parent organization.

Option A: Lock encryption settings for all organizations

  1. Sign in to the administration console.
  2. Go to Settings > Device Backup.
  3. Click Security.
  4. Under Archive Encryption Key:
    1. Deselect Use default archive encryption key setting.
    2. Verify that Standard is selected.
    3. Click Lock to prevent users from changing this setting.
      A confirmation prompt is displayed.
    4. Select inheritance options as desired for your Code42 environment.
    5. Select I understand.
    6. Click Push and Lock.
  5. Click Save.

Option B: Lock encryption settings for a specific organization

  1. Sign in to your administration console.
  2. Go to Organizations.
  3. Select an organization to view its details.
  4. From the action menu, click Device Backup Defaults.
  5. Under General, deselect Use device defaults from parent.
  6. Click Security.
  7. Under Archive Encryption Key:
    1. Deselect Use default archive encryption key setting.
    2. Verify that Standard is selected.
    3. Click Lock to prevent users from changing this setting.
      A confirmation prompt is displayed.
    4. Select inheritance options as desired for child organizations of this organization.
    5. Select I understand.
    6. Click Push and Lock.
  8. Click Save.

Step 2: Enable endpoint monitoring for organizations

Enable endpoint monitoring for each organization in your Code42 environment using the administration console.

Disabled inheritance
If you disable inheritance for an organization, that organization is not affected by changes to its parent organization.

Option A: Enable endpoint monitoring for all organizations

To enable endpoint monitoring on all devices in your Code42 environment:

  1. Sign in to your administration console.
  2. Go to Settings > Endpoint Monitoring.
  3. Select one or more detection types to enable them.
  4. Click Save to immediately apply your changes to all devices in your Code42 environment.

Option B: Enable endpoint monitoring for a specific organization

To enable endpoint monitoring on devices in a specific organization:

  1. Sign in to your administration console.
  2. Go to Organizations.
  3. Select an organization.
  4. From the action menu, choose Edit.
  5. Select Endpoint Monitoring.
  6. Deselect Inherit settings from parent, if necessary.
  7. Select one or more detection types to enable them.
  8. Click Save to immediately apply your changes to all devices in this organization and all of its inheriting child organizations.

Step 3: Configure pattern matching (optional)

In order to use the pattern matching method of endpoint monitoring, you must manually deploy a file to each device you want to monitor for patterns. This file identifies dangerous, malicious, or sensitive files included in the user's backup file selection with a rule-based framework called YARA.

Perform these steps on each device:

  1. Create a folder named yr on the device in the Code42 app's cache directory.
    Default cache directories on each operating system:
    • Windows: C:\ProgramData\CrashPlan\cache
      To view this hidden folder, open a file browser and paste the path in the address bar. If you installed per user, see the file and folder hierarchy for file locations.
    • Mac: /Library/Caches/CrashPlan
      If you installed per user, see the file and folder hierarchy.
    • Linux: /usr/local/crashplan/cache
  2. Create a YARA rule file using the instructions from the YARA project.
    See below for an example YARA rule file.
  3. Save the YARA rule with the name rules.yar to the yr folder.
  4. Restart the Code42 service on the device.

Pattern matching considerations

  • You must manually deploy the YARA rule file to each device you want to monitor for patterns.
  • Unlike the other types of endpoint monitoring, pattern matching only monitors files included in the user's backup file selection.
  • The frequency of pattern matching scans is set by the Backup new version frequency setting. By default, this is every 15 minutes.
  • Pattern matching only monitors files that are created or modified after a YARA rule is added. Files existing before a YARA rule is added are not scanned for that rule until the file changes.
  • Pattern matching can scan for MD5 hash and filename matches on any file, but does not extract file contents of binary or compressed files. Practically speaking, this means pattern matching only searches the contents of plain text files, unless you create a rule targeting a specific binary string.
  • After adding a new YARA rule, you must restart the CrashPlan service on each device.

Sample YARA rule file

The example rule file below includes two rules. Each rule contains instructions for identifying a pattern of data on users' devices, including:

  • An MD5 hash for a specific file
  • Text strings formatted as Social Security numbers
import "hash"

rule md5Match
{
meta:
meta_tag = "MD5 example"

condition:
hash.md5(0, filesize) == "5b110441c6eead0d1943211d6a3e704c"
}

rule ssnMatch
{
meta:
meta_tag = "SSN example"

strings:
$re1 = /(\d{3})-(\d{2})-(\d{4})/

condition:
$re1
}

Step 4: Enable automatic file scanning of detected removable media (optional)

By default, endpoint monitoring does not automatically perform a file scan when a removable drive is detected. This prevents the collection of data on removable media that you may not want to monitor. However, you can enable this automatic file scanning if desired.

  1. Call the Code42 API with the following curl command:
curl -i -X PUT -H 'Content-Type: application/json' -d '{"packets": [{"key": "org-securityTools-device-detection-scan-enable","value": "true","locked": true}]}' -u '<username>:<password>' https://<server_address>:<port>/api/OrgSettings/<orgId>

Setting "locked" to true locks this setting so that it cannot be overridden at the user level.

Replace the following entries with the values of your authority server:

  • Replace <username> and <password> with the administrator username and password.
  • Replace <server_address>:<port> with the host and port of your authority server.
  • Replace <orgId> with the organization ID. To find this ID, export a CSV file containing the organization's data and locate the orgId value in the exported file.
  1. To verify that scanning is enabled, use the following curl command to get all the settings for the organization:
curl -i -X GET -u '<username>:<password>' https://<server_address>:<port>/api/OrgSettings/<OrgID>
  1. Search the output for the "org-securityTools-device-detection-scan-enable" key to verify that its value is set to "true".

Step 5: Exclude paths from monitoring (optional)

You can exclude paths of personal cloud services and removable media if you do not want to monitor them. This can reduce both the amount of unwanted monitoring data and the processing load on user devices.

  1. Call the Code42 API with the following curl command:
curl -i -X PUT -H 'Content-Type: application/json' -d '{"packets":[{"key":"org_securityTools_detection_monitoring_exclusions","value":"{\"windows\":[\"<regEx1>\",\"<regEx2>\"],\"macintosh\":[\"<regEx>\",\"<regEx2>\"]}","locked":true}]}' -u '<username>:<password>' https://<server address>:<port>/api/OrgSettings/<orgId>

Setting the "locked" value to "true" locks this setting so that it cannot be overridden at the user level. If you do not want to use this setting for certain users, you may move the users to a separate child organization with its own setting.

Replace the following entries with the values of your authority server:

  • Replace <regEx1> and <regEx2> with regular expressions for the paths to exclude. You may add as many expressions as you need to exclude multiple paths.
  • Replace <username> and <password> with the administrator username and password.
  • Replace <server_address>:<port> with the host and port of your authority server.
  • Replace <orgId> with the organization ID. To find this ID, export a CSV file containing the organization's data and locate the orgId value in the exported file.
  1. To verify that exclusions are set, use the following curl command to get all the settings for the organization:
curl -i -X GET -u '<username>:<password>' https://<server_address>:<port>/api/OrgSettings/<OrgID>
  1. Search the output for the "org_securityTools_detection_monitoring_exclusions" key to verify that its value is set to the desired paths to exclude from monitoring.

Visualize data from endpoint monitoring

You can visualize the data collected by endpoint monitoring in two ways.

Security Center

Sign in to the Security Center to view basic information from endpoint monitoring in a web browser.

Permissions for Security Center access
The Customer Cloud Admin (cloud only) and SYSADMIN (on-premises only) roles include Security Center access automatically. To grant Security Center access to a user with a different role, assign the Security Center User role to the user.  
  • For Code42 cloud environments: If you recently added Security Tools to your product plan but you can’t access the Security Center, go to My Profile to ensure you have the required permissions. Contact our Customer Champions for Code42 for Enterprise support if you do not have the necessary role or permissions.
  • For on-premises Code42 environments: The default local administrator with the SYSADMIN role can only view user activity in the Security Center for data stored in on-premises storage servers, but cannot view user activity for data stored in the Code42 cloud. To view Code42 cloud data, sign in as a different user with the necessary permissions. 
  1. In a web browser, access the URL for the Security Center.
    Example: https://authority-server.example.com:4285/security
  2. Sign in using your administrative credentials.
  3. Review the basic information gathered by endpoint monitoring.
Security Center requires a trusted certificate for SSL connections
If your Code42 environment uses a self-signed certificate, Security Center activity results do not appear when browsing over an SSL connection. To view results, you must either:

Code42 app for Splunk

Install the Code42 app for Splunk to visualize detailed endpoint monitoring data as part of a larger Splunk installation.

For more information on Splunk, including their free trial that can be used with the Code42 app for Splunk, see Splunk's documentation.