Add a cloud alias to a user profile
Overview
A cloud alias is the username by which an employee accesses cloud storage (such as Google Drive or Box), social media services (like Slack or Twitter), or business tools (like Salesforce). Your employees' usernames for such services may not exactly match their Code42 usernames, which can cause Incydr to incorrectly flag approved activity associated with these usernames as untrusted for further investigation. To resolve such issues and account for all cloud activity (whether associated with a cloud alias or a Code42 username), add cloud aliases to employee user profiles in the Code42 console.
Considerations
Configure cloud aliases when an employee's Code42 username doesn't exactly match their usernames in other monitored applications or data connections. When you add a cloud alias to a user profile:
- Forensic Search returns better search results because searching for user activity returns all file events associated with either their Code42 username or their cloud alias.
- Incydr can account for activity generated by users with sandbox accounts for testing in addition to their production user accounts.
- Incydr can account for different username spellings, conventions, and name changes.
- Incydr uses the cloud alias as part of identifying whether activity is trusted. When a file event is trusted, Incydr filters out that activity and prevents it from appearing on security dashboards or in alert notifications so that you can focus on the risky activity that does require investigation.
- When you add a cloud alias to a user profile, Incydr then considers that alias along with their Code42 username to identify whether a file event is trusted.
- If establishing trust via inferred trust, a cloud alias allows Incydr to match file events that occur in environments monitored by a Code42 data connection (which may be associated with a username that is not their Code42 username) with corresponding file events on a monitored endpoint (which is associated with a Code42 username).
- You'll see an email address that is not the user's Code42 username if either of the following are true:
- The Code42 agent is not installed on that user's endpoint.
- No cloud alias has been set up in that user's profile.
You can configure one cloud alias for each Code42 user in their user profile. You must have either the Insider Risk Admin or Insider Risk Analyst role to add a cloud alias to a user profile.
Add a cloud alias
- Sign in to the Code42 console.
- Access the user profile to which you want to add a cloud alias. You can open a user profile in a number of ways:
- Go to User activity > All users, then select View profile from the Actions
menu to open that user's profile. - Click View profile
when it appears next to a username in the Code42 console. - Click a hyperlinked username in the Code42 console.
- Go to User activity > All users, then select View profile from the Actions
- In the profile's user information panel, click Add next to Cloud Alias.
- Click Add cloud alias.
- Enter the employee's cloud alias, then click Update information.
The new cloud alias is added to the user's profile.