Enable endpoint monitoring and file metadata collection

View existing exclusions

Use the GET method to view existing exclusions. The OrgSettings resource also contains keys for numerous other Code42 settings. Therefore, to view only the monitoring exclusions, you must include the org_securityTools_detection_monitoring_exclusions key as a query parameter.

The example below assumes basic familiarity with curl commands. Use this as a template to create a command specific to your Code42 environment:

Copy to clipboardCopied!

curl -X GET \
  '<request_url>/api/v1/OrgSettings/<OrgID>?keys=org_securityTools_detection_monitoring_exclusions' \
  -H 'cache-control: no-cache' \
  -H 'content-type: application/json' \
  -H 'Authorization: Bearer <auth_token>'

1. Replace <request_url> with the address of your Code42 environment (do not include the brackets in your request).
2. Replace <OrgID> with the numeric ID of the organization you want to update (do not include the brackets in your request). To find this ID, export a CSV file containing the organization's data and locate the orgId value in the exported file.
3. Replace <auth_token> with an authentication token.
4. Execute the curl command in your command-line tool of choice. When prompted, enter your password.
   The Code42 API returns the existing exclusions. If no exclusions exist yet, the data object in the response is empty.

Update or add exclusions

1. Call the Code42 API with the following curl command:
   Copy to clipboardCopied!

   curl -i -X PUT -H 'Content-Type: application/json' -d '{"packets":[{"key":"org_securityTools_detection_monitoring_exclusions","value":"{\"windows\":[\"<regEx1>\",\"<regEx2>\"],\"macintosh\":[\"<regEx>\",\"<regEx2>\"]}","locked":true}]}' -H 'Authorization: Bearer <auth_token>' <request_url>/api/v1/OrgSettings/<orgId>

   Setting the "locked" value to "true" locks this setting so that it cannot be overridden at the user level. If you do not want to use this setting for certain users, you may move the users to a separate child organization with its own setting.

   Replace the following entries with the values of your Code42 cloud instance:

   • Replace <regEx1> and <regEx2> with regular expressions for the paths to exclude. Make sure to include any existing values identified above that you want to continue to exclude. You may add as many expressions as you need to exclude multiple paths.

     Note: File paths must use forward slashes ( / ) for path separators, even for Windows paths. For example: [\"C:/Users/Clyde/Temp(?:.*)*\"]. Using a backslash ( \ ) to escape characters in your regex value is not supported.

   • Replace <auth_token> with an authentication token.
   • Replace <request_url> with the address of your Code42 environment (do not include the brackets in your request).
   • Replace <orgId> with the organization ID. To find this ID, export a CSV file containing the organization's data and locate the orgId value in the exported file.
2. To verify that exclusions are set, use the following curl command:
   Copy to clipboardCopied!

   curl -i -X GET -H 'Authorization: Bearer <auth_token>' https://<admin_console_address>/api/v1/OrgSettings/<OrgID>?keys=org_securityTools_detection_monitoring_exclusions

3. Verify the output values are set to the desired paths to exclude from monitoring.

Update the setting

The steps below assume basic familiarity with curl commands. Use the following example as a template to create a command specific to your Code42 environment:

Copy to clipboardCopied!

curl -X PUT \
  '<request_url>/api/v1/OrgSettings/<OrgID>' \
  -H 'cache-control: no-cache' \
  -H 'content-type: application/json' \
  -H 'Authorization: Bearer <auth_token>' \
  -d '{
    "packets": [
        {
            "key": "org-securityTools-cloud-detection-scan-enable",
            "value": "true",
            "locked": true
        }
    ]
}'

1. Replace <request_url> with the address of your Code42 environment (do not include the brackets in your request).
2. Replace <OrgID> with the numeric organization ID (do not include the brackets in your request). To find this ID, export a CSV file containing the organization's data and locate the orgId value in the exported file.
3. Replace <auth_token> with an authentication token.
4. Set the value parameter to true to enable cloud folder contents scanning. Set the value parameter to false to disable cloud folder contents scanning.
5. Execute the curl command in your command-line tool of choice.

Confirm the setting

Use the GET method to view the current value of the setting. The OrgSettings resource also contains keys for numerous other Code42 settings. Therefore, to view only your customizations, you must include the org-securityTools-cloud-detection-scan-enable key as a query parameter.

The example below assumes basic familiarity with curl commands. Use this as a template to create a command specific to your Code42 environment:

Copy to clipboardCopied!

curl -X GET \
  '<request_url>/api/v1/OrgSettings/<OrgID>?keys=org-securityTools-cloud-detection-scan-enable' \
  -H 'cache-control: no-cache' \
  -H 'content-type: application/json' \
  -H 'Authorization: Bearer <auth_token>'

1. Replace <request_url> with the address of your Code42 environment (do not include the brackets in your request).
2. Replace <OrgID> with the numeric organization ID (do not include the brackets in your request). To find this ID, export a CSV file containing the organization's data and locate the orgId value in the exported file.
3. Replace <auth_token> with an authentication token.
4. Execute the curl command in your command-line tool of choice. When prompted, enter your password.
   The Code42 API returns details about the setting and includes either the key pair "value":"true" (enabled) or "value":"false" (disabled). If the setting has not been defined yet, the data parameter in the response is empty.