Add departing employees

Overview

Use the Code42 Departing Employees list to review the file activity of employees leaving your company and quickly identify anything suspicious. This article explains how to add a user to Departing Employees and use Alerts to help protect you from data loss that may occur when an employee leaves your company.  

Considerations

• Add Trusted Domains in Data Preferences to hide file events that occur on domains you trust. Adding trusted domains helps focus your investigation on file activity that may be a higher risk. File activity on a specific domain is only considered trusted starting the date the domain was added. You can view all file activity, including events that occur on your trusted domains, in Forensic Search.

• This functionality is available only if your product plan includes Risk Detection lenses. Contact your Customer Success Manager (CSM) for assistance with licensing, or to upgrade to an Incydr product plan for a free trial​​​. If you do not know your CSM, please contact our Customer Champions.

• To use this functionality, Incydr users must be assigned specific roles. For more information, see Roles for Incydr. To learn which permissions on Incydr roles allow use of this functionality, see Permissions for Incydr. If you use other Code42 products, see Role assignment use cases.

Before you begin

This article assumes that you have enabled Code42 monitoring on your endpoints and cloud services activity. For more information, see:

• Enable endpoint monitoring and file metadata collection
• Introduction to adding data connections 

Step 1: Add an employee to the Departing Employees list

1. Sign in to the Code42 console. 
2. From the Departing Employees tile on the Risk Exposure dashboard click  Add user to list, or go to User Activity > Departing Employees and click Add to list. 
3. Enter the departing employee's information: 
   1. Code42 username: Enter the Code42 username for the employee and click Continue.
   2. (Optional) Cloud aliases: If the employee has an email alias other than their Code42 username that they use for cloud services such as Google Drive, OneDrive, or Box, click Add Cloud Alias to add and monitor the alias.
      If the Code42 username is the same alias used for cloud services, skip this step. The Code42 username is automatically monitored for file activity in your cloud services. Only one additional alias can be monitored.
   3. (Optional) Departure date: Enter the employee's last day at your company. 
   4. (Optional) Notes: Enter any details for this departing employee, for example, "Has accepted another job offer at a competitor". These notes are visible to team members viewing this user's profile.
4. Click Add employee. 
   The employee is added to the list of departing employees and to the default alerts for suspicious file activity.

Step 2: (Optional) Change default alert settings

1. Go to User Activity > Departing Employees.
2. Click Alert settings.
3. Click View rule for the corresponding alert. 
   The details and criteria for that alert opens in Alerts.
4. Edit the alert rule to update its settings.
   • To change the name, description or severity, click the Actions menu  and select Edit name & description, then make your changes and click Save.
   • To change the criteria, click Edit , then make your changes and click Save.
   • To add a new setting to the rule, click Add setting.
5. Close the details to return to Manage Rules.

Step 3: Investigate employee activity

You can investigate suspicious activity by a departing employee from either an alert notification email you receive, or from the Departing Employees list in the Code42 console directly.  

To investigate activity from an alert notification email:

1. In the notification email, click View Alerts.
2. Sign in to the Code42 console. 
   The Alerts application opens to a filtered list.
3. Review the details of that activity.

To monitor employee activity in the Departing Employees list: 

1. Sign in to the Code42 console. 
2. Go to User Activity > Departing Employees.
3. Locate the employee in the list of departing employees, click the Actions menu , and select View profile.
   The employee's User Profile page appears and shows recent file activity performed by this employee.

Departing Employees default alert settings

When a user is added to the Departing Employees list, they are automatically added to the default Departing Employees alerts within Alerts. These default alerts are listed below, along with their default settings. 

Remove an employee from the Departing Employees list

1. Go to User Activity > Departing Employees.
2. Locate the user in the list of departing employees, click the Actions menu , and select Remove user.
3. In the confirmation message that appears, click Remove employee.
   The employee is removed from the Departing Employees list.

Related topics

• Detect and respond to insider risks 
• Departing Employees reference 
• Introduction to the Code42 command-line interface
• Create and manage alert rules