Skip to main content

Who is this article for?

Incydr Professional and Enterprise
Incydr Basic and Advanced
Other product plans

Incydr Professional and Enterprise, yes.

Incydr Basic and Advanced, yes.

CrashPlan Cloud, no.

Other product plans, yes.

CrashPlan for Small Business, no.

This article applies to Code42 cloud environments.

HOME
GETTING STARTED
RELEASE NOTES
FAQs
APIs
SYSTEM STATUS
Code42 Support

Data Preferences reference

Overview

Data Preferences settings enable you to exclude file activity from IP addresses and domains you trust from dashboard visualizations, alerts, and search results in Forensic Search.

Considerations

  • This functionality is available only when supported by your product plan. Contact your Customer Success Manager (CSM) for assistance with licensing, or to upgrade to the Incydr Advanced product plan for a free trial​​​. If you do not know your CSM, please contact our Customer Champions.

  • To use this functionality, Incydr users must be assigned specific roles. For more information, see Roles for Incydr. To learn which permissions on Incydr roles allow use of this functionality, see Permissions for Incydr. If you use other Code42 products, see Role assignment use cases.

Trusted domains

Adding trusted domains helps focus your investigations on file activity that may be a higher risk by not showing trusted file activity on the Risk Exposure dashboard, detection lists, and alerts. All file activity, including trusted file activity, is available to view in Forensic Search.

How it works

  • Activity is considered trusted when an entry in your list of trusted domains appears in file event metadata for these fields: Active tab titles and URLs, Sync Username, Shared With (for cloud data sources), and Recipients (for email data sources). 
  • File activity on trusted domains does not appear in Code42 security event dashboards, user profiles, and alerts. However, activity on trusted domains is still searchable in Forensic Search.
  • If there is more than one domain associated with an event, all domains must be included in your list of trusted domains for the event to be trusted. If any domain associated with event is not in your list of trusted domains, the event is not trusted.

Configure trusted domains

To view and edit trusted domains:

  1. Sign in to the Code42 console.
  2. Navigate to Administration > Environment > Data Preferences.
  3. Select the Trusted domains tab.

Configure trusted domains

Maintain confidentiality for users reporting misconduct
If your organization has established processes for users to report unethical behavior, harassment, discrimination, or other types of misconduct, consider adding the associated URLs to your list of trusted domains. For example, adding report-misconduct.example.com would prevent file activity on that domain from appearing in Code42 security event dashboards, user profiles, and alerts.
Item Description
a Domain list

List of domains you trust. File events from domains in this list are excluded from:

b Edit

Click Edit to add or remove domains.

  • To add multiple domains, enter a comma-separated list.
  • File activity on a specific domain is only considered trusted starting the date the domain was added to this list. File activity that occurred before the domain was added is considered untrusted.
  • Do not include https:// in the trusted domain entry.
  • Including www in the trusted domain entry is optional. The www prefix is ignored when evaluating trust.
  • Only the domain is evaluated for trust. The protocol (https://) and characters after the top-level domain (TLD) are ignored. For example, for file activity on https://subdomain.corp.example.com/pages, only subdomain.corp.example.com is evaluated for trust.
  • For email activity, a trusted domain entry of example.com trusts activity from all users with email addresses on the example.com domain. Trusting specific email addresses is not supported.
  • Optionally, use the asterisk (*) character as a wildcard for partial domain names. For example, enter *.example.com to trust all subdomains of example.com. See below for more guidance and warnings about wildcards.
Use wildcards carefully to minimize risk
Using a wildcard character may lead to unintentionally trusting unknown or malicious domains. For example, a trusted domain value of example* would trust not only example.com, but also any domain starting with example, such as example.fake.com, examplenotyourrealdomain.com, and example.info.

To trust both a parent domain and all subdomains, we do not recommend an overly inclusive wildcard value, such as *example.com. Instead, add these two values to minimize risk:

  • example.com
  • *.example.com

Since the first entry does not include a wildcard, it only trusts activity that matches the example.com domain exactly. In the second entry, including a period (.) after the wildcard ensures only subdomains of your legitimate domain are trusted.

Trusted domain examples

The table below provides examples of whether file activity is trusted based on the combination of the trusted domain entry and where the file activity occurred.

  • Yes = Activity on this domain is trusted for the supplied trusted domain entry
  • No = Activity on this domain is not trusted for the supplied trusted domain entry                                                            
  Trusted domain entry
   <<<   More secure                                                                                    Less secure  >>>
Activity on: example.com *.example.com example *example.com example* *example*
www.example.com Yes No No Yes Yes Yes
https://subdomain.example.com No Yes No Yes No Yes
www.not-example.com No No No Yes No Yes
www.example.fake.com No No No No Yes Yes
first.last@example.com Yes No No Yes Yes Yes

IP addresses

Listing your in-network IP addresses enables Code42 to label activity from any IP address not on this list as Remote activity. Many areas throughout the Code42 console use this list of IP addresses to identify remote file activity. Listing your in-network IP addresses enables you to customize search results and dashboards to include in-network activity, remote activity, or both.

To view and edit IP addresses:

  1. Sign in to the Code42 console.
  2. Navigate to Administration > Environment > Data Preferences.
  3. Select the IP addresses tab.

Configure IP Addresses

Item Description
a Add

Click to add a new IP address or range.

b IP addresses

The in-network IP address or range.

 

For example, add the public IP addresses used by your devices, such as the NAT IP ranges for your corporate offices.

 

Supported formats:

  • A single IPv4 or IPv6 address. For example: 192.0.2.0.
  • A range of addresses using CIDR block notation format. For example: 192.0.2.0/24.
VPN activity
If you consider file activity from devices connecting over a VPN to be “in-network,” add the IP addresses of your VPN network here. To consider VPN traffic as remote activity, do not include IP addresses for your VPN.
c Description The description entered for this IP address or range. Descriptions are limited to 50 characters.
d Created

Indicates when this entry was added to the list of in-network IP addresses.

 

Date and time are reported in Coordinated Universal Time (UTC).

e IP last modified

Indicates when the IP addresses value was last updated. Updating only the Description does not affect this timestamp. 

 

File activity from an IP address is identified as in-network beginning the date it is added to this list. File activity from an IP address that occurred before it was added to this list is considered remote activity.

 

Date and time are reported in Coordinated Universal Time (UTC).

f Edit Click to edit the IP addresses or Description for this entry.
g Delete Click to delete this entry from the list of in-network IP addresses.
  • Was this article helpful?