Skip to main content

Who is this article for?

Incydr Professional, Enterprise, Gov F2, and Horizon
Incydr Basic, Advanced, and Gov F1

Find your product plan in the Code42 console on the Account menu.
Not an Incydr customer? For CrashPlan articles, search or browse.

Instructor, no.

Incydr Professional, Enterprise, Gov F2, and Horizon, yes.

Incydr Basic, Advanced, and Gov F1, yes.

CrashPlan Cloud, no.

Retired product plans, no.

CrashPlan for Small Business, no.

Code42 Support

Add high-risk employees


Use the High Risk Employees list to review the file activity of employees in your company with high-risk user groups and quickly identify anything suspicious. This article explains how to add a user to the High Risk Employees list and use Alerts to help protect you from data loss that may occur when you have employees that have access to critical data, are on a performance improvement plan, or are actively seeking another job.  


  • Add trusted activity and data connections to focus your investigations on higher-risk file activity. Adding trust settings reduces noise by only showing untrusted file events in Incydr security event dashboards, user profiles, and alerts. All file activity is still visible in Forensic Search.

  • This functionality is available only if your product plan includes Risk Detection lenses. Contact your Customer Success Manager (CSM) for assistance with licensing, or to upgrade to an Incydr product plan for a free trial​​​. If you do not know your CSM, please contact our Customer Champions.

  • To use this functionality, Incydr users must be assigned specific roles. For more information, see Permissions for Incydr

Differences in file event counts
File events for Forensic Search and Alerts typically appear within 15 minutes of the file activity, while file events in the Risk Exposure dashboard and the User Profile may take up to an hour to appear. As a result, you may see that the file event counts in alert notifications and Forensic Search differ from the event counts in the Risk Exposure dashboard and the Departing Employees and High Risk Employees User Profiles.

Before you begin

This article assumes that you have enabled Code42 monitoring on your endpoints and cloud services activity. For more information, see:

Step 1: Add employee to the High Risk Employees list

  1. Sign in to the Code42 console
  2. Click the High Risk Employees tile on the Risk Exposure dashboard, or go to User Activity > High Risk Employees.
  3. Click Add to list.
  4. Enter the employee's information: 
    1. Code42 username: Enter the Code42 username for the employee and click Continue.
    2. (Optional) Cloud alias: If the employee has an email alias other than their Code42 username that they use for cloud services such as Google Drive, OneDrive, or Box, click Add cloud alias to add and monitor the alias.
      If the Code42 username is the same alias used for cloud services, skip this step. The Code42 username is automatically monitored for file activity in your cloud services. Only one additional alias can be monitored.
    3. (Optional) High risk user groups: Select one or more high-risk user groups for this employee.  
    4. (Optional) Notes: Enter any details for this employee. For example, "Has access to customer PII."
      Note: These notes are visible to team members viewing this user's profile.
  5. Click Add employee
    The employee is added to the list of high risk employees and to the default alerts for suspicious file activity.
Add multiple high risk employees with the Code42 CLI
To add multiple high risk employees at once, you can use the Code42 command-line interface. For more information, see the CLI documentation.

Step 2: (Optional) Change default alert settings

  1. Go to User Activity > High Risk Employees.
  2. Click Alert settings.
  3. Click Enable alerts for all high risk employees to turn the default alerts on for all employees listed in High Risk Employees, if not already enabled. 
  4. Click Manage rule for the corresponding alert. 
    The details and criteria for that alert opens in Alerts.
  5. Edit the alert rule to update its settings.
    • To change the name, description or severity, click Actions Alerts actions icon and select Edit name & description, then make your changes and click Save.
    • To change the criteria, click Edit Edit icon in the appropriate panel, then make your changes and click Save.
  6. Close the details to return to the Manage Rules table in Alerts.
Change the list of users monitored by default rules
The default High Risk Employees rules monitor all users added to the High Risk Employees list for file activity. To stop monitoring specified users with the default rules, remove the user from the High Risk Employees list.

Step 3: Investigate employee activity

You can investigate suspicious employee activity from either an alert notification email you receive or directly in the Code42 console using the High Risk Employees list.  

To investigate activity from an alert notification email:

  1. In the notification email, click View Alerts.
  2. Sign in to the Code42 console. 
    The Alerts application opens to a filtered list.
  3. Review the details of that activity.

To monitor employee activity in the High Risk Employees list: 

  1. Sign in to the Code42 console. 
  2. Go to User Activity > High Risk Employees.
  3. Locate the employee in the list of departing employees, click the Actions menu Actions menu, and select View profile.
    The employee's User Profile page appears and shows the employee's previous file activity.

High Risk Employees default alert settings

When a user is added to the High Risk Employees list, they are automatically added to the default High Risk Employees alerts within Alerts. To see the default alert rules, go to User Activity > High Risk Employees > Alert settings > Manage rule. These alerts rules are listed below, along with their default settings. 

Endpoint exposure 

The Endpoint exposure alert triggers when the total size or number of files moved to removable media, synced to a cloud service, read by a browser or other app, or sent to an untrusted cloud destination exceeds the defined limit for this alert. 

  • Severity: High
  • Email Notifications: The default recipient is the person that added the first employee to the Departing Employees or High Risk Employees list. This can be changed at any time.
  • Exposure Type:
    • Read by browser or other app
    • Moved to removable media
    • Moved to cloud sync folders for Box, Box Drive, Dropbox, Apple iCloud, Microsoft OneDrive, Google Drive for Desktop
      Google Drive for Desktop is only supported for Incydr Professional, Enterprise, and Horizon with Code42 app version 1.4.0 or later
  • Time Frame of Events: Within 15 minutes
  • File Size & Count: 500 MB or greater OR 20 or higher
  • File Categories: Any file category

Cloud share permission changes

The Cloud share permission changes alert triggers when the total size or number of files that were shared publicly via a direct link or with users outside your trusted domains exceeds the defined threshold for this alert. 

  • Severity: High
  • Email Notifications: The default recipient is the person that added the first employee to the Departing Employees or High Risk Employees list. This can be changed at any time. 
  • Permissions Changed:
    • Box - Public via direct link, Shared outside trusted domains
    • Google Drive - Public on the web (Google Drive only), Public via Direct Link, Shared outside trusted domains
    • Microsoft OneDrive - Public via direct link, Shared outside trusted domains
  • File Categories: Any file category
High Risk Employees default alerts versus custom alerts
In Alerts, you can create custom alerts to monitor file activity in your environment.

In addition to custom alerts, users on the High Risk Employees list are also automatically added to the default High Risk Employees alerts. To manage both custom alerts and default High Risk Employees alerts, go to Alerts

For more information about how to change the High Risk Employees default alert settings, see Change default alert settings.

Remove an employee from the High Risk Employees list

  1. Go to User Activity > High Risk Employees.
  2. Locate the user in the list of high-risk employees, click the Actions menu Actions menu, and select Remove user.
  3. In the confirmation message that appears, click Remove employee.
    The employee is removed from the High Risk Employees list.
  • Was this article helpful?