Skip to main content

Who is this article for?

Code42 for Enterprise
CrashPlan for Small Business

Code42 for Enterprise, yes.

CrashPlan for Small Business, no.

This article applies to Code42 cloud environments.

HOME
GETTING STARTED
RELEASE NOTES
FAQS
SYSTEM STATUS
Code42 Support

Data Sources reference

Who is this article for?

Code42 for Enterprise
CrashPlan for Small Business

Code42 for Enterprise, yes.

CrashPlan for Small Business, no.

This article applies to Code42 cloud environments.

Overview

Use the Data Sources page in the Code42 console to add and manage third-party services that are connected to Code42. 

Data Sources

To add and manage data sources, go to Investigation > Data Sources.
Data sources are not available in the Code42 federal environment.

Data sources

Item Description
a Add data source Adds and configures a new data source connection.
b Service

Displays the cloud service or email service data source:

  • Cloud services
    • Box

    • Google Drive
    • Microsoft OneDrive for Business
  • Email services
    • Google Gmail
    • Microsoft Office 365 DLP
c Service type Displays the data source type, either Cloud or Email.
d Display name

Displays the name you use to distinguish between data sources. For example, if your organization has two different GSuite accounts for US and UK employees, you could name each account's Google Drives to help identify them as such. This name must be unique.

e Status

Displays the status of the connection between Code42 and the data source. For details, see Data source statuses.

f

View details View details

Click to view more information about that data source.

Data source details

For any connection listed in the Data Sources table, click View details View details to view more information about that data source.

Data source details

Item Description
a Display name

The name given to the data source connection when it was set up.

b Service

The cloud service (Box, Google Drive, or Microsoft OneDrive for Business) or email service data source (Google Gmail or Microsoft Office 365 DLP).

c Service type The data source type, either Cloud or Email.
d Scoped to

The scope used to identify what to monitor for the data source:

  • For cloud services, the drives that are monitored. Code42 can monitor the drives for all users, drives of specific users, or drives of users in specific groups. For Google Drive, all shared drives are monitored. 
  • For email services, email accounts for all users are monitored.
e Status

The status of the connection between Code42 and the data source. For details, see Data source statuses.

f Status history

A brief history of the data source connection, including the date the data source was initially added along with the username of the Code42 administrator that configured the data source connection. The date and time does not update if you deauthorize and then resume monitoring the data source.

g Deauthorize / Resume monitoring Click to deauthorize the data source, or to resume monitoring a data source that has been deauthorized.

This action is not available for data sources with a status of Initializing, Maintenance, Deauthorizing, or Deleting.

Data source statuses

The Data Sources table's Status column displays the status of Code42's connection to the data source. For cloud services, more specific drive information appears on the data source details panel under Status.

Status Description

Initializing

(not available for Box cloud services)

Google Drive and Microsoft OneDrive cloud services

During initialization, Code42 discovers all of the drives in your environment within scope, then indexes all of the files in those drives. This gathers baseline data that is identified in Forensic Search as "new files." This initial indexing does not calculate hash values for files. Instead, hashes are calculated when subsequent activity for that file is detected.

 

On the data source details panel, we show the total number of user drives discovered in your environment, the number of drives that Code42 is currently initializing, and the number of user drives that have completed initialization and that Code42 is now monitoring. For Google Drive, a second section lists similar values for the shared or team drives in your environment.

 

While drives that have completed initialization begin reporting ongoing activity immediately, the cloud service connection as a whole does not transition to the Monitoring status until all drives are initialized.

 

Email services

During initialization, Code42 is registering with the email service in order to begin monitoring email file attachment activity. Email service initialization does not index user inboxes. Instead, Code42 discovers all email accounts in your environment and registers them for monitoring. 

 

While the email accounts that have completed registration with Code42 begin reporting ongoing email attachment activity immediately, the email service connection does not transition to the Monitoring status until all user email accounts are discovered and have completed registration.

Monitoring, indexing in progress

(Box cloud services only)

Once you complete authorization, Code42 immediately begins monitoring your Box environment for ongoing file activity. At the same time, Code42 indexes all of the files for all discovered drives that are within scope to gather baseline data. File events become available in Code42 soon after they occur. If file activity occurs for an un-indexed file, that file is immediately indexed and subsequent file activity is sent to Code42. 

 

As with Google Drive and OneDrive, this initial indexing does not calculate hash values for files. Instead, hashes are calculated when subsequent activity for that file is detected.

 

On the data source details panel for a Box cloud service, we show the total number of drives that Code42 has discovered in your environment and is monitoring for ongoing activity. Of this total, we then list the number of drives that are currently being indexed along with the number of drives for which indexing is complete.

 

After all drives have been indexed, the Box cloud service connection status transitions to the Monitoring status. As drives are created or added to scope, this status briefly changes back to "Monitoring, indexing in progress" to indicate these new drives are discovered and have started indexing.

Monitoring

Cloud services

Code42 has discovered all in-scope user drives and has completed the initial indexing of those drives. Code42 is monitoring for ongoing file activity while also checking for new files. Any new files discovered during monitoring are hashed. By default Code42 checks the cloud service every 5 minutes for new files and the latest file activity.

 

On the data sources details panel for Google Drive and OneDrive cloud services, we display the number of user drives we are monitoring in your environment along with the number of drives that have been newly discovered. For Box, the total number of drives that Code42 is monitoring is listed.

 

For Google Drive and OneDrive, new drives are discovered at midnight and then go through the initialization process. For Box, new drives are discovered immediately and are monitored during the initial index process.

 

Email services

Code42 is connected to the data source and is monitoring outbound email activity for file attachments. All email accounts are monitored. New email accounts are discovered at midnight and are registered for monitoring.

Maintenance Code42 is currently performing maintenance on the data source connection. The data source is still being monitored for file or email activity, but these events won't be displayed in Code42 until maintenance completes. After maintenance completes, Code42 displays all file events collected during the maintenance period.
Error

There was an error connecting to the data source. This typically occurs when a majority of user drives or email accounts are inaccessible to Code42 due to permissions or licensing issues within the data source. This can also occur immediately after a data source is authorized if that data source is already registered to Code42.

 

To address common errors, deauthorize and resume monitoring that data source. Contact our Customer Champions for support with persistent errors.

Deauthorizing Code42 is removing its authorization to monitor the data source. For data sources with a large number of drives or email accounts that are monitored by Code42, this process may take an hour or longer. When this process completes, the status moves to Deauthorized.
Deauthorized

Code42's connection to the data source has been removed and no new event activity is being collected. The data source will remain deauthorized and listed in the table for 90 days following the date of deauthorization. All discovered drives, email accounts, and existing file events remain in Code42 for those 90 days and can be viewed in Forensic Search.

 

Once the 90-day period lapses, Code42 deletes its connection to the data source along with all information collected. To resume monitoring the data source after deletion, you need to re-authorize and re-initialize it.

Deleting Code42 is removing its connection to the data source and deleting any information about that data source, such as initialized drive information and collected file events. For data sources with a large number of drives or email accounts that are monitored by Code42, this process may take an hour or longer. When this process completes, the data source is removed from the Data Sources table.

Add data source connection

To add a data source connection, click Add Data Source.

Add data source connection.

Item Description
a Data Source

Selects a data source to add:

b Display Name The name you use to distinguish between data sources, for example, for different Google Drive accounts for US employees and UK employees. This name must be unique.
  • Was this article helpful?