Enable endpoint monitoring for file exfiltration detection
Who is this article for?
Incydr, no.
CrashPlan for Enterprise, no.
Code42 for Enterprise, yes.
CrashPlan for Small Business, no.
Overview
Endpoint monitoring uses the Code42 app to capture file activity on user devices in real time, helping you track user behavior to identify potential data leaks or security problems.
Code42's file exfiltration detection captures file activity anywhere on a user's device, not just within the user's backup file selection, related to removable media, cloud services, uploads and downloads via web browsers and other applications, and file restores. It also searches contents of files selected for backup for specified text patterns.
Videos
Watch the video below to learn how to enable file exfiltration detection.
Watch the video below for an overview of file exfiltration detection.
For more videos, visit the Code42 University.
Endpoint monitoring types
Enabling endpoint monitoring in your Code42 environment allows you to detect the following categories of potential file exfiltration activity:
- Removable media: Monitors file activity on removable media, such as USB drives or SD cards.
- Cloud service: Monitors file activity in folders on the device used for syncing with cloud services, including:
- Box
- Box Drive (Mac only, version 6.8.4 and later)
- Dropbox
- Google Backup and Sync (version 6.7.1 and later)
- Google Drive (version 6.5.2 and earlier; see permissions requirements)
- Apple iCloud
- Microsoft OneDrive
- Version 7.0 and later: Code42 watches a personal OneDrive account and up to two OneDrive for Business accounts on each device.
- Version 6.x: OneDrive for Business is not supported.
- Application activity: Identifies files opened in apps commonly used for uploading and downloading files, such as a web browser, Slack, FTP client, or curl.
- Devices using Code42 app versions older than 7.0.0 only monitor activity in web browsers, and only on Windows devices. Version 7.0.0 expands upload and download detection to include Macs as well as other applications, such as Slack, FileZilla, FTP, and cURL.
- Code42 server version 8.2 and later label this Browser and other Application Activity. Versions 6.5 - 6.8 label this Browser activity. Version 6.0.x labels it File upload.
- File restore: Monitors files restored through the Code42 app and the Code42 console, both by users and administrators (versions 7.0.5 and earlier).
- Pattern matching: Checks for the existence of known malicious files or patterns of sensitive data based on YARA rules for text (non-binary) files included in the user's backup file selection (versions 7.0.5 and earlier).
Considerations
- Code42 recommends only enabling endpoint monitoring in a small, test organization at first. If your Code42 environment contains more than 5,000 users, contact your Customer Success Manager (CSM) for assistance creating a deployment strategy.
- In version 7.x and earlier, Linux devices are not supported. In version 8.2 and later, removable media detection is supported on Linux devices, but all other endpoint monitoring types listed above are Windows and Mac only.
- If Compliance Settings are activated for an organization, you cannot enable endpoint monitoring for that organization or any of its child organizations that inherit settings. Parent and sibling organizations are not affected.
Windows devices may require administrator action to monitor activity in the Google Drive folder:
- Code42 app version 6.5.1 and later: If the Code42 app is installed by a member of the administrator's group, no action is required. If the Code42 app is not installed by a member of administrator's group, you must grant read access to SYSTEM for the Google Drive folder on each device.
- Code42 app version 6.5.0 and earlier: You must grant read access to SYSTEM for the Google Drive folder on each device because, by default, Google Drive grants read access to the logged-in user only, and the Code42 service runs as a system process.
Before you begin
- Ensure your Code42 environment meets the following requirements:
- You must have a product plan that includes file exfiltration detection.
- The Code42 app must be installed for all users. Per-user installations are not supported.
- User devices must be running a currently supported version of the Code42 app.
- Users' archives must use the Standard archive encryption key policy. Endpoint monitoring data cannot be collected for users with Archive key password or Custom key archive encryption.
- Create a test organization, and then add a small number of test users to use in the steps below for initial endpoint monitoring testing. Alternatively, use the Change Organization command to move a small number of existing users into the test organization.
Enable endpoint monitoring for file exfiltration detection
Step 1: Lock archive encryption key settings
Endpoint monitoring requires standard encryption. Before implementing endpoint monitoring in any organization in your Code42 environment, you must lock the encryption setting to prevent users or administrators from changing it later.
Option A: Lock encryption settings for all organizations
- Sign in to the Code42 console.
- Go to Administration > Settings > Device Backup.
- Select the Security tab.
- In the Archive Encryption Key section:
- Verify that Standard is selected.
- Click the Lock icon to prevent users from changing this setting.
A confirmation prompt is displayed. - Select inheritance options as desired for your Code42 environment.
- Select I understand.
- Click Ok.
- Click Save.
Option B: Lock encryption settings for a specific organization
- Sign in to the Code42 console.
- Select Administration > Organizations > Active. (In versions 6.0.x, select Organizations.)
- Select an organization.
- From the action menu, click Device Backup Defaults.
- In the General section, deselect Use device defaults from parent.
- Select the Security tab.
- In the Archive Encryption Key section:
- Deselect Use default archive encryption key setting.
- Verify that Standard is selected.
- Click the Lock icon to prevent users from changing this setting.
- Review the confirmation message and click OK.
- Click Save.
Step 2: Enable endpoint monitoring for organizations
Code42 recommends enabling endpoint monitoring in a test organization first to ensure settings are properly configured to capture the user activity you want to monitor. Once you see the desired results with a small number of users, then start enableing endpoint monitoring one organization at a time.
Option A: Enable endpoint monitoring for a specific organization
To enable endpoint monitoring on devices in a specific organization:
- Sign in to the Code42 console.
- Select Administration > Organizations > Active. (In versions 6.0.x, select Organizations.)
- Select an organization.
- From the action menu, select Edit.
- Select the Endpoint Monitoring tab.
- Deselect Inherit settings from parent, if necessary.
- Select one or more detection types to enable them.
- Click Save to immediately apply your changes to all devices in this organization and all of its inheriting child organizations.
Option B: Enable endpoint monitoring for all organizations
In most cases, it is better to enable endpoint monitoring one organization at a time (option A above). We only recommend enabling endpoint monitoring for all organizations at once if you have already tested endpoint monitoring with a small number of users first, and you have less than 5,000 users in your Code42 environment. If your Code42 environment contains more than 5,000 users, contact your Customer Success Manager (CSM) for assistance creating a deployment strategy.
To enable endpoint monitoring on all devices in your Code42 environment:
- Sign in to the Code42 console.
- Go to Administration > Settings > Endpoint Monitoring.
- Select one or more detection types to enable them.
- Click Save to immediately apply your changes to all devices in your Code42 environment.
Optional configuration steps
Steps 3 - 6 below are optional configuration settings, and are not required to start capturing file activity. If you want to configure any of these items to override the Code42 defaults, click the + icon next to each step for detailed instructions.
Step 3: Configure pattern matching
Step 4: Enable automatic file scanning of detected removable media
Step 5: Exclude paths from monitoring
Step 6: Enable automatic file scanning of cloud folders
Review file activity
Details of monitored exfiltration activity are available in both the Code42 console and in the Code42 for Splunk (Legacy) app.
Code42 console
- Sign in to the Code42 console.
- Navigate to User Activity.
- Version 8.2 and later: Select Investigation > User Activity.
- Version 7.x and earlier: Select Security Center > User Activity.
- Enter a username.
- Enter a date range.
- Click Search.
- Review the Activity Results.
- For more details, select the action menu in the upper-right of any chart and select Export CSV. The exported file contains extensive details about the file activity.
Code42 for Splunk (Legacy) app
Install the Code42 for Splunk (Legacy) app to gain access to dashboards and other detailed information about file exfiltration activity in your Code42 environment.
For more information on Splunk, including their free trial that can be used with the Code42 for Splunk (Legacy) app, see Splunk's documentation.