Configure activity profiles

Overview

Code42's file exfiltration detection capabilities enable security teams to monitor file activity for specific high-risk users and receive an email notification when suspicious activity occurs, which helps provide insight into potential exfiltration threats.

To get started, define file activity thresholds in an activity profile. Activity profiles use data from Code42's endpoint monitoring to generate an email notification when a user exceeds a defined threshold for:

• Transferring files to removable media
• Interacting with cloud services (including Box, Dropbox, Google Backup and Sync, iCloud, and OneDrive)

Before you begin

• Activity notifications and profiles are not available in the Code42 federal environment. Instead, use Alerts to create alert rules that automatically notify you of suspicious file activity.
• Enable endpoint monitoring for the organizations you want to monitor.
• Ensure user devices in those organizations meet the Code42 app version requirements for endpoint monitoring.

Create an activity profile

An activity profile defines specific thresholds for the number or total size of files moved to removable media or cloud services.

1. Sign in to the Code42 console.
2. Select Investigation > Activity Notifications.
3. Select Create New Profile.
4. Enter a name.
   The name appears in the list of profiles on the Activity Notifications screen. You can change the name at any time.
5. Enter the email address of the person to receive notifications. Email notifications are limited to a single address.
6. Select the scan frequency. The frequency determines how often records are scanned and the email recipient notified. For example, selecting Every 2 hours generates an email if a user exceeds a file activity threshold within a two-hour period.
7. Choose the file activities to be included in the profile.
   • Removable Media: Monitors file transfer activity to USB drives, external hard drives, memory cards, etc.
   • Cloud Services: Monitors file transfer activity for the Box, Box Drive (Mac only), Dropbox, Google Backup and Sync, Apple iCloud, and Microsoft OneDrive apps installed on user devices.
8. Define Total file size, Total file count, or both threshold values. Notification occurs if either value is exceeded. You can choose to ignore either file size or file count as a criteria, but you cannot ignore both. These values, combined with the email frequency defined above, define if and when a notification is sent.
   • Total file size: Defines the total size of files in megabytes (MB) a user must move to generate a notification.
   • Total file count: Defines the total number of files a user must move to generate a notification.
9. Click Save.
   The new activity profile appears with the option to add users.

Add users to an activity profile

1. Sign in to the Code42 console.
2. Select Investigation > Activity Notifications.
3. Select a profile from the list.
4. Select Add User.
5. Starting typing a username. Select a username from the list of suggestions to add that user to the profile. Repeat this step to add multiple users.
   The user is added to the Included Users section.
6. Click Add Users.

Remove users from an activity profile

1. Sign in to the Code42 console.
2. Select Investigation > Activity Notifications.
3. Select a profile from the list.
4. Select one or more users.
5. Select Remove User.
6. Review the confirmation message and select Yes, Remove.

Edit an existing activity profile

1. Sign in to the Code42 console.
2. Select Investigation > Activity Notifications.
3. Select a profile from the list.
4. From the action menu , select Edit This Profile.
5. Change activity profile settings as necessary.
6. Click Save.

Delete an activity profile

1. Sign in to the Code42 console.
2. Select Investigation > Activity Notifications.
3. Select a profile from the list.
4. Select Delete Profile.
5. Review the confirmation message and select Yes, Delete.

Video

Watch the video below for an overview of file exfiltration detection. For more videos, visit the Code42 University. 

Related topics

• User Activity and Activity Notifications reference
• Conflict detected in endpoint monitoring settings and activity profile
• Error deleting activity profile
• Enable endpoint monitoring for file exfiltration detection
• Endpoint Monitoring settings reference