Skip to main content

Who is this article for?

Code42 for EnterpriseSee product plans and features
CrashPlan for Small Business 

CrashPlan for Small Business, no.

Code42 for Enterprise, yes.

Link: Product plans and features.

This article applies to Code42 cloud environments.

Code42 Support

View remote file activity

Who is this article for?

Code42 for EnterpriseSee product plans and features
CrashPlan for Small Business 

CrashPlan for Small Business, no.

Code42 for Enterprise, yes.

Link: Product plans and features.

This article applies to Code42 cloud environments.

Overview

An increasingly remote workforce can make it difficult to know whether your data is secure. Using your in-network IP addresses, Code42 can identify file activity that occurs outside your known IP addresses (remote activity). By viewing remote activity, you can see how your data is moving, where it is moving to, and who has access to it, even if your employees work from home. You can also use this view to see if any data is moving to unauthorized cloud accounts or unsanctioned websites via browser uploads from unknown IP addresses.

Considerations

  • The network traffic from a remote workforce may overwhelm your virtual private network (VPN). For more information about how to adjust your network settings to accommodate remote workers, see Manage Code42 network traffic for remote employees
  • Add Trusted Domains in Data Preferences to filter out Read by browser or other app file events from domains you trust. Adding trusted domains helps focus your investigation on file activity that may be a higher risk. File activity on a specific domain is only considered trusted starting the date the domain was added. 

  • To view remote file activity, you must have roles that provide the necessary permissions. We recommend you use the roles in our use case for investigating suspicious file activity
  • This functionality requires a Code42 Platinum product plan. Contact your Customer Success Manager (CSM) for assistance with licensing, or to upgrade to the Platinum product plan for a free trial​​​. If you don't know who your CSM is, email csmsupport@code42.com

Before you begin

To view remote file activity, you must first:

Remote activity does not include cloud permission changes
The All activity view only includes events captured from the employee's endpoint, such as files moved to removable media, uploaded via a browser or other app, and moved into a cloud sync folder on the endpoint. 

It does not include events from cloud services where the permissions for a file were changed.

Review employees with the most remote activity

  1. Sign in to the Code42 console.
  2. Select Detection > Risk Exposure
  3. On the Top users by file activity tile, click View by remote activity.
  4. For any employee listed, click:
    1. Investigate in Forensic SearchInvestigate in Forensic Search to see all the impacted files in {{forensicsearch}.
    2. View event details View event details  to see more information about the employee's file events such as destination and file category group.

View a summary of all remote file activity

You can view a high-level summary of all file activity occurring across your organization for all of your employees on the All activity view. From there, use the Remote activity tab to see all file activity across your organization that is occurring on out-of-network IP addresses. 

To view remote file activity:

  1. Sign in to the Code42 console.
  2. Select Detection > Risk Exposure
  3. From the All activity view, click the Remote activity tab.
  4. To dig further into the data, do any of the following:
  • Hover on any bar to see file event counts and file sizes for the activity of all of your remote activity for the selected time frame. 
  • Click any bar in By destination or click View event details View event details to see the file activity for that destination by file category groups (such as business documents, source code, or compressed files) as well as the most active employees for that destination.
  • Click any bar in By file category group or click View event details View event details to see the file activity for that file category group by destination as well as the employees with the most activity for that file category group.
  • For any item, click Investigate in Forensic SearchInvestigate in Forensic Search to see all of the impacted files in Forensic Search
  • Was this article helpful?