File Metadata Collection exclusions

Step 1: Find your top-level OrgID

To view and edit exclusions, you must first identify your top-level organization's numeric ID:

1. Sign in to the Code42 console.
2. Select Administration > Environment > Organizations.
3. Select your top-level organization. This organization is at the top of the organizational hierarchy and is the parent for all other organizations.
4. In the web browser's address bar, note the numeric ID in the URL after "organization" but before any query or token parameters. In this example, the OrgID is 123456: https://console.us.code42.com/console/#/organization/123456?t=78910

Step 2: View existing exclusions

Use the GET method to view existing exclusions. The OrgSettings resource also contains keys for numerous other Code42 settings. Therefore, to view only the exclusions, you must include the appropriate key as a query parameter.

The example below assumes basic familiarity with curl commands. Use this as a template to create a command specific to your Code42 environment:

Copy to clipboardCopied!

curl -X GET \
  '<request_url>/api/OrgSettings/<OrgID>?keys=device_fileForensics_fileExclusions_org' \
  -H 'cache-control: no-cache' \
  -H 'content-type: application/json' \
  -H 'Authorization: Bearer <auth_token>'

1. Replace <request_url> with the address of your Code42 environment (do not include the brackets in your request).
2. Replace <OrgID> with the number identified in Step 1 above (do not include the brackets in your request).
3. Replace <auth_token> with an authentication token.
4. For Incydr Professional and Enterprise, change the key from device_fileForensics_fileExclusions_org to artemis_device_fileForensics_fileExclusions_org.
5. Execute the curl command in your command-line tool of choice. When prompted, enter your password.
   The Code42 API returns the existing exclusions. If no exclusions exist yet, the data object in the response is empty.

Step 3: Update or add new exclusions

Use the PUT method to add or modify exclusions. Before sending any updates, make sure to complete Step 2 above to obtain the list of existing exclusions.

The steps below assume basic familiarity with curl commands. Use the following example as a template to create a command specific to your Code42 environment.

Copy to clipboardCopied!

curl -X PUT \
  '<request_url>/api/OrgSettings/<OrgID>' \
  -H 'cache-control: no-cache' \
  -H 'content-type: application/json' \
  -H 'Authorization: Bearer <auth_token>' \
  -d '{ 
    "packets": [
        {
            "key": "device_fileForensics_fileExclusions_org",
            "value": {
                "all":[ "'.*cache.*'" ], 
                "macintosh":[ "'.*.db'" ], 
                "windows":[ "'.*.etl'", "'.*.tmp'" ] 
            },
            "locked": true
        }
    ]
}'

1. Replace <request_url> with the address of your Code42 environment (do not include the brackets in your request).
2. Replace <OrgID> with the number identified in Step 1 above (do not include the brackets in your request).
3. Replace <auth_token> with an authentication token.
4. For Incydr Professional and Enterprise, change the key from device_fileForensics_fileExclusions_org to artemis_device_fileForensics_fileExclusions_org.
5. Define exclusions with regex for each operating system in use in your Code42 environment. Defining specific exclusions for each operating system minimizes the resources required on user devices. In this example:
   • All devices will exclude files with the .cache extension
   • Mac devices will exclude files with the .db extension
   • Windows devices will exclude files with the .etl extension
   • Windows devices will exclude the AppData directory
6. Execute the curl command in your command-line tool of choice. When prompted, enter your password.
   A 204 No Content response indicates the Code42 cloud received the request and applied the exclusions to user devices.