Skip to main content

Who is this article for?

Code42 for EnterpriseSee product plans and features
CrashPlan for Small Business 

CrashPlan for Small Business, no.

Code42 for Enterprise, yes.

Link: Product plans and features.

This article applies to Cloud.

Code42 Support

Departing Employees reference

Who is this article for?

Code42 for EnterpriseSee product plans and features
CrashPlan for Small Business 

CrashPlan for Small Business, no.

Code42 for Enterprise, yes.

Link: Product plans and features.

This article applies to Cloud.

Overview

From Departing Employees, you can review the file activity of employees leaving your company, helping you to:

  • Quickly identify suspicious file movement
  • Review endpoint and cloud services activity
  • See file activity for the previous 90 days

This article describes the information and options in the Departing Employees application.

For instructions on how to add users to Departing Employees and investigate suspicious file activity, see Add departing employees.

Considerations

To access to the Departing Employees application, you must have: 

Departing Employees

To access the Departing Employees application:

  1. Sign in to the administration console.
  2. Select Detection > Departing Employees. 

Departing Employees list

The Departing Employees screen lists the users who have been added as departing employees. 

Departing employees list

Item Description
a Alert Settings

Click to open the Alert Settings window, from which you can:

  • Enable or disable all alerts for all departing employees  
  • Click Manage Alert Settings to go to the Alerts > Manage Rules tab and change the settings for the default Departing Employees alerts. From there, you can also update your custom alerts.
b Add Departing Employee Click to add a new user to the list of departing employees and start reviewing their file activity.  
c Rows per page Select to display 10, 25, 50, or 100 employees per page.
d Employee

Displays the employee's name and Code42 username. 

e Date Added Displays the date the employee was added to the Departing Employees list.
f Column sort Click the up arrow to sort results by this column in ascending order. Click the down arrow to sort in descending order.
g Departure Date Lists the date entered as the employee's departure date when the case was created. If no date was entered, no value is listed.
h Notes Any additional information entered when the case was created. If no notes were added, no value is shown.
i View User Profile Opens the User Profile page for the employee.
j Remove User Removes the employee's profile from the Departing Employees application.

User Profile

To view an employee's user profile, click the View User Profile icon View User Profile in the list of employees. 

Departing employee profile

Item Description
a Departing Employees  Click to go back to the list of employees.
b Employee information

Displays a summary of the employee's information, including:

  • Employee name
  • Planned date of the employee's departure
  • Employee's Code42 username
  • Employee's cloud aliases (not shown in image)
  • Notes for this the case
c Edit Click to edit employee information, including cloud aliases, the departure date, and notes for this case.
d Last 30 Days

Shows a summary of file activity in the last 30 days for:

  • Removable media: File activity on removable media, such as a USB drive.
  • Synced to Cloud Services: Files were added to folders on a user's device that are typically used to sync to a cloud service. 
  • Read by Browser or Other App: Files were uploaded by a browser or an app such as Slack, FTP client, or curl.

Click Investigate in Forensic Search to see the search results for these files in Forensic Search.

e Endpoint File Activity Displays file activity on the user's device, which helps identify suspicious file activity and potential file exfiltration.
f Last Select last 90 Days, 30 Days, 7 Days, or 1 Day to update the timeframe on the graph.
g Activity type

Indicates the type of activity displayed in the graph.

h Last updated Shows how much time has lapsed since the graph was last updated.
i Date Added Indicates the date the employee was added to the Departing Employees application.
j Graph

Visual representation of file activity for the selected timeframe.

  • Hover on a point in the graph to see a preview of the activity.
  • Click a point on the graph to see more details about the activity. Within the details, click Investigate in Forensic Search to see even more specific file event details in Forensic File Search.
k Forensic Search icon Search icon Click to see these files in Forensic Search.
l Show activity for
(Endpoint file activity)

Select one of the following options to view the graph of that activity:

  • Removable media: Shows a graph of file activity on removable media, such as a USB drive.
  • Synced to Cloud Services: Shows a graph of activity where files were added to folders on a user's device that are typically used to sync to a cloud service. 
  • Read by Browser or Other App: Shows a graph of activity where files were opened by a browser or an app commonly used for uploading files, such as Slack, FTP client, or curl.
  • Deleted Files: Shows a graph of activity where files are added to the following locations: $Recycle.Bin, .local/share/Trash, and .Trash
  • Archived Files: Shows a graph of activity for common archive file formats, including compressed files (.zip, .tar).
m Cloud File Activity Shows activity for files in cloud services where permissions changed to be available publicly or were shared with a direct link.
n Show activity for
(Cloud File Activity) 

Select one of the following options to view the graph of that activity:

  • Public on the web (Google Drive): Shows files in Google Drive that were made public.
  • Public via direct link (Google Drive): Shows files that were shared from Google Drive with a direct link.
  • Public via direct link (OneDrive): Shows files that were shared from OneDrive with a direct link.
  • Public via direct link (Box): Shows files that were shared from Box with a direct link.