Skip to main content

Who is this article for?

Code42 for EnterpriseSee product plans and features
CrashPlan for Small Business 

CrashPlan for Small Business, no.

Code42 for Enterprise, yes.

Link: Product plans and features.

This article applies to Cloud.

Code42 Support

Departing Employees reference

Who is this article for?

Code42 for EnterpriseSee product plans and features
CrashPlan for Small Business 

CrashPlan for Small Business, no.

Code42 for Enterprise, yes.

Link: Product plans and features.

This article applies to Cloud.

Overview

From Departing Employees, you can review the file activity of employees leaving your company, helping you to:

  • Quickly identify suspicious file movement
  • Review endpoint and cloud services activity
  • See file activity for the previous 90 days

This article describes the information and options in the Departing Employees application.

For instructions on how to add users to Departing Employees and investigate suspicious file activity, see Add departing employees.

Considerations

To access to the Departing Employees application, you must have: 

Departing Employees

To access the Departing Employees application:

  1. Sign in to the administration console.
  2. Click the Departing Employees application tile on the Risk Exposure dashboard, or go to Detection > Departing Employees. 

Departing Employees list

The Departing Employees screen lists the users who have been added as departing employees. 

List of departing employees

Item Description
a Alert Settings

Click to open the Alert Settings window, from which you can:

  • Enable or disable all alerts for all departing employees.
  • View details about the rules such as severity, who gets email notifications when the rule threshold is exceeded, as well as exposure type and thresholds for that rule. 
  • Click Manage Rule to go to the Alerts > Manage Rules tab and change the settings for the default Departing Employees alerts. From there, you can also update your custom alerts.
b Add Departing Employee Click to add a new user to the list of departing employees and start reviewing their file activity.  
c Total Departing Employees  Click to see a list of all departing employees. This option is selected by default.
d Leaving Today Click to see the employees that have a departure date of today.
e Put Data at Risk in Last 24 Hours Click to see the employees that had suspicious file activity in the past 24 hours.
f Put Data at Risk in the Last 30 Days Click to see the employees that had suspicious file activity in the past 30 days.
g Employee

Displays the employee's name and Code42 username. Click their Code42 username to see their User Profile.

h Department/Title

Displays the employee's department and their title if you use provisioning. (If you use User Directory Sync or SCIM provisioning, this information is automatically populated by your provisioning provider. If you use Okta provisioning, you must first add the department and title attributes in Okta.) If you don't use provisioning, this information does not appear and cannot be added manually.

i Date Added Displays the date the employee was added to the Departing Employees list.
j Departure Date Lists the date entered for the employee's departure. If no date was entered, no value is listed.
k Notes Displays any additional information entered when the profile was created. If no notes were added, this field is blank.
l View User Profile Opens the User Profile page for the employee.
m Remove User Removes the employee's profile from the Departing Employees application.
n Rows per page Select to display 10, 25, 50, or 100 employees per page.
o Pagination Click forward or backward to see pages of results.

User Profile

To view an employee's user profile, click the View User Profile icon View User Profile in the list of employees. 

Employee information

Employee information

Item Description
a Employee information

Displays a summary of the employee's information, including:

  • Name
  • Department* 
  • Title*
  • Location*
  • Manager*
  • Employee's Code42 username
  • Employee's cloud aliases (not shown in image)
  • Departure Date (Departing Employees application only)
  • Notes (Departing Employees application only)

*Displays this information If your Code42 environment uses provisioning. (If you use User Directory Sync or SCIM provisioning, this information is automatically populated by your provisioning provider. If you use Okta provisioning, you must first add the attributes in Okta.) If you don't use provisioning, this information does not appear and cannot be added manually.

 

b Edit Click to edit employee information, including cloud aliases, the departure date, and notes.

Employee's file activity for past 30 days

File Activity tile of the User Profile with the Synced to Cloud Service Filter selected

Item Description
a Synced to Cloud Service

Click to see the number of file events that indicate files were added to folders on the employee's device that are typically used to sync to a cloud service. The selected filter is highlighted in blue.

 

Hover over a summary bar of data to see a preview of these files broken down by file category and file category group.

b On Removable Media

Click to see the number of file events that indicate files were moved to removable media, such as a USB drive. File category groups appear on the left. The selected filter is highlighted in blue.

 

Hover over a summary bar of data to see a preview of these files broken down by file category.

c Read by Browser or Other App 

Click to see the number of file events that indicate files were uploaded to a browser or an app such as Slack, FTP client, or curl. File category groups appear on the left. The selected filter is highlighted in blue.

 

Hover over a summary bar of data to see a preview of these files broken down by file category.

d By File Category Group

Shows the summary of file activity in the past 30 days for the following file categories:

  • Business Documents
    • PDF
    • Spreadsheets
    • Documents
    • Presentations
  • Zip Files
    Common archive file formats including compressed files.
  • Source Code
    Common source code formats.
  • Multimedia 
    • Image
    • Video
    • Audio
  • Other
    • Script
    • Virtual Disk Image
    • Executable
    • Uncategorized (files that did not fit any category)

For more information about file categories, see Forensic File Search file categories.

e Sync Destination

Shows the cloud services provider that the file was synced to. Hover over a summary bar of data to see a preview of these files broken down by file category group.

f Forensic Search icon Forensic Search icon

Click to see the search results for these files in Forensic Search.

Endpoint File Activity

This section of the User Profile displays file activity on the user's device, which helps identify suspicious file activity and potential file exfiltration.

Employee's endpoint file activity

Item Description
a Last

Select last 90 Days30 Days7 Days, or 1 Day to update the timeframe on the graph. Click Refresh graph indicator to refresh the graph and show the latest data.

b Activity type Indicates the type of activity displayed in the graph.
c Summary preview

Click a point on the graph to see a summary of that data point organized by file category. 

d Forensic Search icon Forensic Search icon

Click to see the search results for these files in Forensic Search.

e Last Updated

Shows how much time has lapsed since the graph was last updated and when new data is available. Refresh the page to see the latest data.

f Graph

Provides a visual representation of file activity for the selected timeframe.

  • Hover on a point in the graph to see a preview of the activity.
  • Click a point on the graph to see the summary preview of that data point. 
g Show activity for

Select one of the following options to view the graph of that activity:

  • On Removable media: Shows a graph of file activity on removable media, such as a USB drive.
  • Synced to Cloud Service: Shows a graph of activity where files were added to folders on a user's device that are typically used to sync to a cloud service. 
  • Read by Browser or Other App: Shows a graph of activity where files were opened by a browser or an app commonly used for uploading files, such as Slack, FTP client, or curl.
  • Deleted Files: Shows a graph of activity where files are added to the following locations: $Recycle.Bin, .local/share/Trash, and .Trash. 
  • Zip Files: Shows a graph of activity for common archive file formats, including compressed files (.zip, .tar).
h Forensic Search icon Forensic Search icon

Click to see the search results for these files in Forensic Search.

 

Cloud File Activity

This section of the User Profile displays file activity for files in cloud services. It shows when a file is made publicly accessible or shared via a direct link. 

Employee's cloud file activity

Item Description
a Last 

Select last 90 Days30 Days7 Days, or 1 Day to update the timeframe on the graph. Click Refresh graph indicator to refresh the graph and show the latest data.

b Activity type Indicates the type of activity displayed in the graph.
c Summary preview

Click a point on the graph to see a summary of that data point organized by file category. 

d Last updated

Shows how much time has lapsed since the graph was last updated and when new data is available. Refresh the page to see the latest data.

e Forensic Search icon Forensic Search icon

Click to see the search results for these files in Forensic Search.

f Graph

Provides a visual representation of file activity for the selected timeframe.

  • Hover on a point in the graph to see a preview of the activity.
  • Click a point on the graph to see the summary preview of that data point. 

g Show activity for

Select one of the following options to view the graph of that activity:

  • Public on the web (Google Drive): Shows files in Google Drive that were made public.
  • Public via direct link (Google Drive): Shows files that were shared from Google Drive with a direct link.
  • Public via direct link (OneDrive): Shows files that were shared from OneDrive with a direct link.
  • Public via direct link (Box): Shows files that were shared from Box with a direct link.
  • Zip Files: Shows a graph of activity for common archive file formats, including compressed files (.zip, .tar).

 

h Forensic Search icon Forensic Search icon

Click to see the search results for these files in Forensic Search.

Related topics