Endpoint monitoring

Option A: Lock encryption settings for all organizations

1. Sign in to the Code42 console.
2. Go to Settings > Device Backup.
3. Click Security.
4. Under Archive Encryption Key:
   1. Deselect Use default archive encryption key setting.
   2. Verify that Standard is selected.
   3. Click Lock to prevent users from changing this setting.
      A confirmation prompt is displayed.
   4. Select inheritance options as desired for your Code42 environment.
   5. Select I understand.
   6. Click Push and Lock.
5. Click Save.

Option B: Lock encryption settings for a specific organization

1. Sign in to your Code42 console.
2. Go to Organizations.
3. Select an organization to view its details.
4. From the action menu, click Device Backup Defaults.
5. Under General, deselect Use device defaults from parent.
6. Click Security.
7. Under Archive Encryption Key:
   1. Deselect Use default archive encryption key setting.
   2. Verify that Standard is selected.
   3. Click Lock to prevent users from changing this setting.
      A confirmation prompt is displayed.
   4. Select inheritance options as desired for child organizations of this organization.
   5. Select I understand.
   6. Click Push and Lock.
8. Click Save.

Option A: Enable endpoint monitoring for all organizations

To enable endpoint monitoring on all devices in your Code42 environment:

1. Sign in to your Code42 console.
2. Go to Settings > Endpoint Monitoring (labeled Detection in version 5.1.x).
3. Select one or more detection types to enable them.
4. Click Save to immediately apply your changes to all devices in your Code42 environment.

Option B: Enable endpoint monitoring for a specific organization

To enable endpoint monitoring on devices in a specific organization:

1. Sign in to your Code42 console.
2. Go to Organizations.
3. Select an organization.
4. From the action menu, choose Edit.
5. Select Endpoint Monitoring (labeled Detection in version 5.1.x).
6. Deselect Inherit settings from parent, if necessary.
7. Select one or more detection types to enable them.
8. Click Save to immediately apply your changes to all devices in this organization and all of its inheriting child organizations.

Pattern matching considerations

• You must manually deploy the YARA rule file to each device you want to monitor for patterns.
• Unlike the other types of endpoint monitoring, pattern matching only monitors files included in the user's backup file selection.
• The frequency of pattern matching scans is set by the Backup new version frequency setting. By default, this is every 15 minutes.
• Pattern matching only monitors files that are created or modified after a YARA rule is added. Files existing before a YARA rule is added are not scanned for that rule until the file changes.
• Pattern matching can scan for MD5 hash and filename matches on any file, but does not extract file contents of binary or compressed files. Practically speaking, this means pattern matching only searches the contents of plain text files, unless you create a rule targeting a specific binary string.
• After adding a new YARA rule, you must restart the CrashPlan service on each device.

Sample YARA rule file

The example rule file below includes two rules. Each rule contains instructions for identifying a pattern of data on users' devices, including:

• An MD5 hash for a specific file
• Text strings formatted as Social Security numbers

import "hash"

rule md5Match
{
meta:
meta_tag = "MD5 example"

condition:
hash.md5(0, filesize) == "5b110441c6eead0d1943211d6a3e704c"
}

rule ssnMatch
{
meta:
meta_tag = "SSN example"

strings:
$re1 = /(\d{3})-(\d{2})-(\d{4})/

condition:
$re1
}