Review Alerts reference
Overview
Code42 Alerts let you know when important data may be leaving your company. Use the Review Alerts table to view or dismiss alert notifications, add notes to a notification, and select the status of any associated investigation.
This article is a reference guide with detailed descriptions of the notifications in the Review Alerts table. For more information on how to work with alerts, see View and manage alert notifications. Use the Manage Rules table to view or update the different alert rules you have in your Code42 environment that trigger these notifications. For information about alert rules and their components, see Manage Rules reference. For information on creating and configuring alert rules, see Create and manage alert rules.
Considerations
Review Alerts
Alert notifications are listed in the Review Alerts table when activity matching the settings defined in alert rules is detected. To view the table, in the Code42 console select Alerts > Review Alerts.
| Item | Description | |
|---|---|---|
| a | Trust settings | |
| b | Risk settings |
Click to open Risk settings, from which you can set the score of each risk indicator. Scores are used to calculate the severity of each file event. For more information, see the Risk settings reference. |
| c | Filter | Filters the Review Alerts list by the criteria you select. For more information, see Filter alerts below. |
| d | Filtered by | The filters that are currently applied to the Review Alerts list. Click the X to remove that filter. Remove all filters to view all alerts. |
| e | Select all |
Selects all alerts and presents an action button (Dismiss alerts or Reopen alerts). Click the button to perform that action on all selected alerts at once.
You cannot add notes when you use select all. |
| f | Risk severity |
The risk severity associated with the event, based on its risk indicators. Risk severities are based on the following scoring ranges:
If the risk severity is unknown, — appears in this column.
For more information about risk indicators, see Risk settings reference. |
| g | Rule name | Name entered for the rule that generated the alert. |
| h | Alert generated | Date and time the alert was generated. |
| i | Column sort  |
Click the column header to sort results by this column in ascending or descending order. |
| j | Username/Actor | The Code42 username or the cloud alias associated with the file events that generated the alert. |
| k | Status |
The status of the alert: Open, In progress, Pending response, and Dismissed.
Statuses indicate the alert's current state and identify any specific stages of an investigation into that notification. |
| l | Dismiss  or Reopen alert  |
Opens a menu to dismiss or reopen the current alert. You can also choose to add a note to the alert before you dismiss or reopen it.
|
| m | View detail  |
Click to view alert details for this notification. Includes file event information, file count and size, and file categories involved in the event. |
| n | Rows per page | Select the number of alerts to display on each page. |
| o | Pagination | Click the right and left arrows to scroll through pages of alerts. |
9+: Critical
7-8: High
4-6: Moderate
1-3: Low
0: No risk indicatedFilter alerts
To filter the alerts listed on Review Alerts, click Filter and select the criteria to use. When you click Apply, alerts that match all filters appear in the list.
Any filters that are applied are shown above the Review Alerts list. Click the X on a filter to remove that filter.
| Item | Description | |
|---|---|---|
| a | Status |
Filters the list by status:
|
| b | Date range |
Filters the list by the selected date range: alerts triggered in the last 24 hours, 7 days, 30 days, or select Custom and enter the start and end dates to use to filter alerts. You can also select All dates to view all alerts that have been triggered.
The Custom and All dates filters show only the notifications that have occurred within your product plan's event data retention period (30, 90, or 180 days), even if you enter a custom date that is outside that window. |
| c | Risk severity |
Filters the list by risk severity: shows alerts with Critical, High, Moderate, or Low risk scores, or alerts with any risk severity. Risk severities are based on the following scoring ranges:
For more information about risk indicators, see Risk settings reference. |
| d | Username or actor |
Filters the list to show only file events associated with a specific Code42 username or cloud alias (actor). |
| e | Rule name | Filters the list to show only alerts associated with a specific rule name. |
| f | Cancel / Apply | Click Apply to apply the selected filter criteria to the list and display only the alerts that match that criteria. To return to the list without applying any filters, click Cancel. |
Alert details
For any alert listed on Review Alerts, click View detail 
to see more information about the alert notification.
Alert details vary depending on the type of activity that triggered the alert. Specific alerts may display different details than those shown in the example below.
The Alert details is divided into several sections:
- Actions that you can take on the alert (such as investigating it in Forensic Search or emailing the user about the questionable activity) appear at the top.
- The Overview lists general information about the alert, such as the rule and user that generated the alert, a summary of the activity that generated the alert, the timeframe in which the activity occurred, and the number of files involved in the endpoint or cloud activity.
- The events and details sections at the bottom of the notification give more information about the specific events and files involved in the activity. These details describe the type of activity that generated the alert, identify the specific files involved in the activity and list the associated risk scores, and display additional information captured when the activity was detected.
| Item | Description | |
|---|---|---|
| a | Alert ID | The unique identifier for the alert notification. Click Copy link  to copy the link to the alert notification in the Code42 console so that you can share it with others for further investigation. |
| b | Investigate in Forensic Search |
Click to view these file events in Forensic Search.
If multiple event types are involved in the activity that generated the alert, select the type of events you want to view in Forensic Search from the menu that appears:
|
| c | Dismiss alert or Reopen alert | For an open alert, click to remove this individual alert notification from the list of open alerts. This dismisses the notification for any teammates.
For an alert that has been dismissed, click to reopen this individual alert notification and return it to the list of open alerts. |
| d | Actions | |
| Overview | ||
| e | Rule name |
The name of the rule that generated the alert.
Either the description entered for the rule or a brief description of the rule settings that triggered the alert is listed under the rule name for your reference.
Click View rule |
| f | Instructor lesson | Details about the Code42 Instructor lesson automatically sent when the alert was triggered. Click View Instructor lessons  to open Code42 Instructor and view lessons. |
| g | Status |
The status of the alert: Open, In progress, Pending response, and Dismissed.
Statuses provide more context about what's happening with an alert or record specific stages of an alert's investigation.
Code42 automatically saves and displays the user name of the last person to update the alert's status, along with the date and time the status was changed. |
| h | Notes |
Any notes that have been entered for the alert.
|
| i | Risk severity |
The risk severity associated with the event, based on its risk indicators. Risk severities are based on the following scoring ranges:
For events with an unknown risk severity, this row does not appear.
For more information about risk severities and indicators, see Risk settings reference. |
| j | Risk summary |
A brief summary of the risk indicators that contributed to the event's risk severity. For more information about risk severities and indicators, see Risk settings reference.
This summary condenses detected events for a given severity. For example, the summary could indicate that there are 6 moderate events that include 6 file mismatches, 3 events from Slack, 3 remote activity events, and 3 events from Box. This means that 6 file mismatches were detected and 3 of them occurred on Slack and 3 on Box. Of those 6 file mismatches, 3 occurred on IP addresses that are not in-network. Use Forensic Search to identify the specific file events that are condensed into this summary.
For events with an unknown risk severity, this row does not appear. |
| k | Username or Actor |
The Code42 username or the cloud alias associated with the file events that triggered the alert. If the user is included on any watchlists, that indicator appears for reference.
View profile
Click to view the User Profile for that user. |
| l | Time range of events |
Displays the time period in which the file activity occurred.
|
| m | File total | The total number and size of files involved in the suspected exposure. |
| -- |
Endpoint IP addresses
(not shown in example) |
The public IP address of the endpoint involved in the file activity. If the IP address was not collected, this row does not appear.
Remote activity highlights file activity by IP addresses that are not listed as an in-network IP address in Administration > Environment > Data Preferences.
Endpoint IP addresses are listed only for endpoint events. |
| -- |
Cloud sharing
(not shown in example) |
The domains (such as "example.com") and email addresses (such as "first.lastname@example.com") that a file has been shared with that are outside of the domains you trust.
Cloud sharing details are listed only for cloud events.
Microsoft OneDrive does not provide email addresses to Code42. Therefore, email addresses that are outside of the domains you trust cannot be listed here for files shared in OneDrive.
Only the first 10 email addresses are listed. Investigate in Forensic Search to view other email addresses the file has been shared with that are outside trusted domains. |
| Event and file details | ||
| n | Event type |
The type of activity that generated the alert:
Each event type detected is listed, along with details about the files involved in that event. Specific files may be listed in multiple event types when they are involved in those activities. |
| o |
Filename/Details |
The filename involved in the activity, along with details about the risk indicators that contributed to its risk severity and risk score. Risk severities are based on the following scoring ranges:
For more information about risk indicators, see Risk settings reference.
When available, additional details about the event (such as the URL and active tab title involved in the activity, or the email addresses the file was shared with) are listed. These details vary depending on the event type, but can include:
For more information about the details displayed here, see File event metadata reference.
Click Investigate in Forensic Search to view these files in Forensic Search. |
| p | Investigate events in Forensic Search |
Click to see these files in Forensic Search. |
to 
appears when either: