Departing Employees reference
Who is this article for?
Incydr, yes.
CrashPlan for Enterprise, no.
Code42 for Enterprise, yes.
CrashPlan for Small Business, no.
This article applies to Code42 cloud environments.
Overview
From Departing Employees, you can review the file activity of employees leaving your company, helping you to:
- Quickly identify suspicious file movement
- Review endpoint and cloud services activity
- See file activity for the previous 90 days
This article describes the information and options in the Departing Employees list.
For instructions on how to add users to Departing Employees and investigate suspicious file activity, see Add departing employees.
Considerations
- To work with departing employees, you must have roles that provide the necessary permissions. We recommend you use the roles in our use case for adding users to detection lists.
Departing Employees
To access the Departing Employees list:
- Sign in to the Code42 console.
- From the Departing Employees tile on the Risk Exposure dashboard, click any value, or go to Detection > Departing Employees.
Departing Employees list
The Departing Employees screen lists the users who have been added as departing employees.
| Item | Description | |
|---|---|---|
| a | Alert Settings  |
Click to open the Alert Settings window, from which you can:
|
| b | Add Departing Employee | Click to add a new user to the list of departing employees and start reviewing their file activity. |
| c | Total Departing Employees | Click to see a list of all departing employees. This option is selected by default. |
| d | Leaving Today | Click to see the employees that have a departure date of today. |
| e | Put Data at Risk in Last 24 Hours | Click to see the employees that had suspicious file activity in the past 24 hours. |
| f | Put Data at Risk in the Last 30 Days | Click to see the employees that had suspicious file activity in the past 30 days. |
| g | Employee |
Displays the employee's name and Code42 username. Click their Code42 username to see their User Profile. |
| h | Department/Title |
Displays the employee's department and their title if you use provisioning. (If you use User Directory Sync or SCIM provisioning, this information is automatically populated by your provisioning provider. You must first add the department and title attributes if you use Okta provisioning or PingOne provisioning.) If you don't use provisioning, this information does not appear and cannot be added manually. |
| i | Total File Events | Displays the number of file events in which a file was
moved to removable media or cloud sync folders, read by a browser or other app, or had its cloud share permissions changed. |
| j | Total Size of Files | Lists the total size of the files included In the file event activity. |
| k | Departure Date | Lists the date entered for the employee's departure. If no date was entered, no value is listed. |
| l | User Profile Notes | Displays any additional information entered when the profile was created. If no notes were added, this field is blank. These notes are visible to your team members. |
| m | View profile  |
Opens the User Profile for the employee. |
| n | Remove employee .png?revision=1) |
Removes the employee's profile from the Departing Employees list and from the view of your team members. |
| o | View event details  |
Click to view the employee's file events broken down by destination and file category group. |
| p | Rows per page | Select to display 10, 25, 50, or 100 employees per page. |
| q | Pagination | Click forward or backward to see pages of results. |
User Profile
To view an employee's user profile, click the View profile icon 
in the list of employees.
Employee information
| Item | Description | |
|---|---|---|
| a | Departing Employee indicator |
Indicates that this employee has been added to the Departing Employees list.
Click to remove the employee from the Departing Employees list. This will remove the employee from the Departing Employees list for your team members as well. |
| b | Employee information |
|
| c | Profile details | Information that was added to the employee's profile from the Departing Employees list or High Risk Employees list. |
| d | Edit  |
Click to edit employee information, including cloud aliases, the departure date, and notes. |
Endpoint activity
| Item | Description | |
|---|---|---|
| a | Endpoint activity | Shows file activity that occurred on the endpoint by destination and by file category group. File activity includes when files are added to a cloud sync folder on the device, opened in a browser or other app, or moved to an external device. |
| b | Cloud sharing | Shows file activity that occurred when a user changed the permission of a file in your cloud service from private to public. |
| c |
Last (on User Profile only) |
Select last 90 Days, 30 Days, 7 Days, or 1 Day to update the timeframe shown. |
| d | Cloud services | Shows the cloud services provider that the file was synced to. Click a summary bar of data to see the file activity broken down by file category group. |
| e | Browser or app | |
| f | Removable media | |
| g | By file category group |
|
| h | Forensic Search icon |
|
| i | View event details  |
Click to view the employee's file events broken down by file category group. |
Cloud sharing
| Item | Description | |
|---|---|---|
| a | Endpoint activity | Shows file activity that occurred on the endpoint such as when files are added to a cloud sync folder on the device, opened in a browser or other app, or moved to an external device |
| b | Cloud sharing | Shows file activity that occurred when a user changed the permission of a file in your cloud service from private to public. Shows file activity by cloud service and file category group. Note: To see cloud sharing activity, you must allow Code42 access to your cloud services. |
| c | Last | Select last 90 Days, 30 Days, 7 Days, or 1 Day to update the timeframe shown. |
| d | Cloud service |
Shows the cloud service in which files were made publicly available or shared via direct link. Cloud services include Box, Google, or Microsoft OneDrive. |
| e | Permission increases | Shows the number of file events where a user changed the permission of a file in your cloud service from private to public. |
| f | File category group | |
| g | Forensic Search icon |
|
| h | View event details |
Click to view the employee's file events broken down by destination. |
Endpoint activity over time
This section displays file activity on the user's device, which helps identify suspicious file activity and potential file exfiltration.
| Item | Description | |
|---|---|---|
| a | Last |
Select last 90 Days, 30 Days, 7 Days, or 1 Day to update the timeframe on the graph. Click |
| b | Activity type | Indicates the type of activity displayed in the graph. |
| c | Summary preview | |
| d | Risk indicators |
Highlights file activity that has added risk. For more information about risk indicators, see Introduction to risk indicators.
File Mismatch - Indicates that the files involved with the file activity have extensions that do not match the file contents. For example, a file with the .jpg extension that is actually a .zip file.
Off hours - Indicates file activity that occurred outside the employee’s typical active hours. With File Metadata Collection enabled, Code42 captures file activity from an employee’s endpoint and uses that pattern of activity to highlight file activity that occurs during times a user is typically inactive (their off hours). Off Hours requires File Metadata Collection
You must have File Metadata Collection enabled in order to see the Off Hours indicator. Off Hours appears only on the Endpoint File Activity graph
While the File Mismatch indicator is shown on both the Endpoint File Activity and Cloud File Activity graphs for corresponding activity, the Off Hours indicator appears only on the Endpoint File Activity graph. Cloud services are not currently monitored for activity that occurs during off hours. |
| e | Forensic Search icon  |
|
| f | Graph | |
| g | Show activity for | |
to refresh the graph and show the latest data.Cloud sharing over time
This section displays file activity for files in cloud services. It shows when a file is made publicly available.
| Item | Description | |
|---|---|---|
| a | Last | Select last 90 Days, 30 Days, 7 Days, or 1 Day to update the timeframe on the graph. Click |
| b | Activity type | Indicates the type of activity displayed in the graph. |
| c | Summary preview | Click a point on the graph to see a summary of that data point organized by file category group. |
| d | Risk Indicators |
Highlights file activity that has added risk.
File Mismatch - Indicates that the files involved with the file activity have extensions that do not match the file contents, for example, a file with the .jpg extension that is actually a .zip file.
For more information about risk indicators, see Introduction to risk indicators. |
| e | Forensic Search icon |
Click to see the search results for these files in Forensic Search. |
| f | Graph |
Provides a visual representation of file activity for the selected timeframe.
|
| g | Show activity for |
Select one of the following options to view the graph of that activity:
|
| h | Permission increases | Shows the number of file events where a user changed the permission of a file in your cloud service from private to public. |