Destination activity over time reference

Shows all endpoint and cloud service* activity across your organization. File events include files:

• Moved to removable media or cloud sync folders
• Viewed in a browser or other app
• Shared publicly via direct link or with specific users outside your trusted domains 

*To see cloud service activity, give Code42 access to your cloud services.

Shows all remote file activity that occurred on an endpoint. File events can include files moved to removable media or cloud sync folders, or viewed in a browser or other app. 

When configured, remote activity is detected for endpoint events from out-of-network IP addresses. 

Choose destination

Where the file was sent. Destinations include:

• AirDrop: Files were sent to a device via AirDrop. The destination category for AirDrop events is listed as "Device" in the Exposure section of Forensic Search. 
• Cloud destinations: The file was synced to a cloud service, shared publicly via direct link, or shared with specific users outside your trusted domains. 
  • Cloud sharing activity includes file activity from Box, Google Drive, and OneDrive and details how the file was shared (for example, public via direct link).

  • Cloud folder sync activity (when a file exists in a folder on the device that is used for syncing with a cloud service) includes activity from:

    • Apple iCloud
    • Box
    • Box Drive
    • Dropbox
    • Google Backup and Sync
    • Google Drive
    • Microsoft OneDrive
• Email services: The file was uploaded to an email provider via a web browser.
• Messaging services: The file was sent via a messaging service. 
• Removable media: The file was moved to an external device such as a USB drive or hard drive. Click View event details to see file activity broken out by removable media device vendor and bus type. 
• Social media: The file was uploaded to social media. This does not necessarily mean it's posted publicly; for example, the file could have been sent in a direct message on LinkedIn, etc.
• Source code repository: The file was uploaded to a location typically used for storing code files.
• Other: File activity where the destination does not match any of the above destinations, or in the following special cases:
  • Files were opened in an app that is commonly used for uploading files such as FTP client or curl
  • We cannot determine the destination. On Macs, this may indicate Code42 does not have the required permissions to collect the destination details.
  • Multiple possibilities appears if the user accessed more than one tab while uploads were in progress. Review the Active tab titles and URLs to identify all possible destinations.