From Departing Employees, you can review the file activity of employees leaving your company, helping you to:
- Quickly identify suspicious file movement
- Review endpoint and cloud services activity
- See file activity for the previous 90 days
This article describes the information and options in the Departing Employees list.
For instructions on how to add users to Departing Employees and investigate suspicious file activity, see Add departing employees.
Add Trusted Domains in Data Preferences to hide file events that occur on domains you trust. Adding trusted domains helps focus your investigation on file activity that may be a higher risk. File activity on a specific domain is only considered trusted starting the date the domain was added. You can view all file activity, including events that occur on your trusted domains, in Forensic Search.
- To add or remove departing employees, you must have roles that provide the necessary permissions. We recommend you use the roles in our use case for adding users to detection lists.
File events for Forensic Search and Alerts typically appear within 15 minutes of the file activity, while file events in the Risk Exposure dashboard and the User Profile may take up to an hour to appear. As a result, you may see that the file event counts in alert notifications and Forensic Search differ from the event counts in the Risk Exposure dashboard and the Departing Employees and High Risk Employees User Profiles.
To access the Departing Employees list:
- Sign in to the Code42 console.
- From the Departing Employees tile on the Risk Exposure dashboard, click any value, or go to User Activity > Departing Employees.
Departing Employees list
The Departing Employees screen lists the users who have been added as departing employees.
Click to open the Alert Settings window, from which you can:
|b||Add departing employee||Click to add a new user to the list of departing employees and start reviewing their file activity.|
|c||Total departing employees||Click to see a list of all departing employees. This option is selected by default.|
|d||Leaving today||Click to see the employees that have a departure date of today.|
|e||Put data at risk in last 24 hours||Click to see the employees that had suspicious file activity in the past 24 hours.|
|f||Put data at risk in the last 30 days||Click to see the employees that had suspicious file activity in the past 30 days.|
Displays the employee's name and Code42 username. Click their Code42 username to see their User Profile.
Displays the employee's department and title if you use provisioning. (If you use User Directory Sync or SCIM provisioning, this information is automatically populated by your provisioning provider. You must first add the department and title attributes if you use Okta provisioning or PingOne provisioning.) If you don't use provisioning, this information does not appear and cannot be added manually.
|i||Events||Displays the number of file events in which a file was
moved to removable media or cloud sync folders, read by a browser or other app, or had its cloud share permissions changed.
|j||Size||Lists the total size of the files included In the file event activity.|
|k||Departure date||Lists the date entered for the employee's departure. If no date was entered, no value is listed.|
|l||User profile notes||Displays any additional notes entered when the profile was created. If no notes were added, this field is blank. These notes are visible to your team members.|
|m||View profile||Opens the User Profile for the employee.|
|n||Remove employee||Removes the employee's profile from the Departing Employees list and from the view of your team members.|
|o||View event details||Click to view the employee's file events broken down by destination and file category group.|
|p||Rows per page||Select to display 10, 25, 50, or 100 employees per page.|
|q||Pagination||Click forward or backward to see pages of results.|
To view an employee's user profile, click View profile in the list of employees.
|a||Departing Employee indicator||
Shows that this employee has been added to the Departing Employees list. Click to jump to the Departing Employees list.
Click the "x" on the indicator to remove the employee from the Departing Employees list. This will remove the employee from the Departing Employees list for your team members as well.
Displays a summary of the employee's information, including:
*Displays this information if your Code42 environment uses provisioning. (If you use Code42 User Directory Sync or SCIM provisioning, this information is automatically populated by your provisioning provider. If you use Azure AD provisioning, the attributes are automatically populated. You must first add the attributes if you use Okta provisioning or PingOne provisioning. ) If you don't use provisioning, this information does not appear and cannot be added manually. If user attributes are not populated correctly, see Updated user attributes not populating in risk detection lists.
|c||Profile details||Information such as risk factors, departure date, or profile notes that was added to the employee's profile from the Departing Employees list or High Risk Employees list.|
|d||Edit||Click to edit employee information, including cloud aliases, departure date, and User profile notes.|
Destination activity over time
Destinations are dynamic
The list of destinations shown on each tab of this graph is dynamic. Only destinations with file activity are shown.
For example, if there is no Box file activity in the selected timeframe, or if you have not given Code42 access to your Box environment for monitoring, the Box destination is not listed.
|a||Timeframe||Displays file activity for the last 90 days, 30 days, 7 days, or 1 day.|
Shows all endpoint and cloud service activity across your organization. (To see cloud service activity, give Code42 access to your cloud services.)
File events include files:
Shows all remote file activity that occurred on an endpoint. File events can include files moved to removable media or cloud sync folders, or viewed in a browser or other app.
When configured, remote activity is detected for endpoint events from out-of-network IP addresses. The Remote activity tab does not show cloud sharing events.
|d||Destination||Displays the currently selected destination.|
Select a destination to see where the file was sent. Destinations include:
|f||Events||Number of file events associated with the destination for the selected timeframe.|
|g||Events bar graph||Shows a visual representation of the number of file events.|
|h||Size||Total size of files involved with the file activity.|
|i||Activity preview||Shows a visual representation of file activity for the selected timeframe.|
Highlights file activity that has added risk. For more information about insider risk indicators, see Introduction to risk indicators .
File Mismatch - Indicates that the files involved with the file activity have extensions that do not match the file contents. For example, a file with the .jpg extension that is actually a .zip file.
Off hours - Indicates file activity that occurred outside the employee’s typical active hours. With File Metadata Collection enabled, Code42 captures file activity from an employee’s endpoint and uses that pattern of activity to highlight file activity that occurs during times a user is typically inactive (their off hours).
Off Hours requires File Metadata Collection
You must have File Metadata Collection enabled in order to see the Off Hours indicator.
Off Hours appears only for endpoint activity
While the File Mismatch indicator is shown for both the endpoint and cloud sharing file activity, the Off Hours indicator only appears on endpoint events. Cloud services are not currently monitored for activity that occurs during off hours.
|k||Forensic Search||Opens Forensic Search and pre-populates it with the selected timeframe and exposure type. Learn more about using Forensic Search.|
|l||View event details||Click to view the file events broken down by file category group.|
|a||Endpoint activity||Shows all endpoint file activity across your organization. File events include files moved to removable media or cloud sync folders, or viewed in a browser or other app.|
|b||Cloud sharing||Shows file activity where permissions were increased on a file in your cloud services, making the file shared publicly via direct link. This tab requires Code42 access to your cloud services.|
|c||Timeframe||Displays file activity for the last 90 days, 30 days, 7 days, or 1 day.|
|d||File category group||
Shows the summary of file activity for the following file categories:
For more information about file categories, see Forensic Search file categories.
|e||Events||Displays the count of total file events for a file category group. The default sort order is from the highest number of events to the lowest.|
|f||Events bar graph||Shows a visual representation of the number of file events.|
|g||Size||Displays the total file size of file events for a file category group.|
|h||Activity preview||Shows a visual representation of file activity for the selected timeframe.|
|i||Forensic Search||Opens Forensic Search and pre-populates it with the selected timeframe and exposure type. Learn more about using Forensic Search.|
|j||View event details||Click to view the details of file events for a file category group.|