Code42 for IBM Resilient customization settings

Code42: Add user to legal hold

This function adds a user as a custodian to a Code42 legal hold. The legal hold matter must already exist in Code42.

• code42_user_uid (Text): The user's unique ID. See the user_uid of the user details returned by the Get user by username function. 
• code42_legal_hold_uid (Text): the unique identifier of the Code42 legal hold matter. Get the legal_hold_uid from the Code42 console as follows: 
  1. Sign in to the Code42 console.
  2. Choose Legal Hold > Matters from the navigation menu.
  3. From the list of all matters, click on the name of the matter. 
  4. Copy the string of numbers at the end of the web browser URL. 
     For example, the code42_legal_hold_uid for the following URL would be 645576513911664484:

https://console.us.code42.com/app/#/legal-hold/legal-matters/645576513911664484

• result (dict): Legal hold membership. See the Example Response Body in the API Documentation for output syntax.
• error (str): If result is None, information on the cause. 

Exception if the function cannot connect to Code42

Code42: Block device

This function signs the user out of the Code42 app on that device and prevents them from being able to sign in again on that device. Backup continues. Learn more about blocking devices.

• code42_device_id (Text): Identification number for the device. See the computerId property of the device details returned by the following functions: 

  • Get device by GUID
  • Search devices 

• result (bool): True if the request was successful, False if otherwise.
• error (str): Information on the failure, or None

Exception if the function cannot connect to Code42.

Code42: Block user

This function blocks a user so they cannot access Code42, but backup continues. Learn more about blocking users.

user_id (Text): Identification number for the user. See the userId property of the user details returned by the following functions: 

• Get user by username
• Get user by UID
• Search users

• result (bool): True if the request was successful, False if otherwise.
• error (str): Information on the failure, or None

Exception if the function cannot connect to Code42.

Code42: Deactivate device

With this function, the user cannot access Code42 and backup archives are moved to cold storage.  Learn more about deactivating devices.

code42_device_id (Text): Identification number for the device. See the computerId property of the device details returned by the following functions: 

• Get device by GUID
• Search devices

• result  (bool): True if the request was successful, False if otherwise
• error (str): Information on the failure, or None

 Exception if the function cannot connect to Code42.

Code42: Deactivate user

User cannot access Code42 and backup archives are moved to cold storage. Learn more about deactivating users.

code42_user_id (Text): Identification number for the user. See the userId property of the user details returned by the following functions: 

• Get user by username
• Get user by UID
• Search users

• result  (bool): True if the request was successful, False if otherwise
• error (str): Information on the failure, or None

 Exception if the function cannot connect to Code42. 

Code42: Deauthorize device

Signs the user out of the Code42 agent. The user can sign in again. Data is not removed or deleted. Learn more about deauthorizing devices.

code42_device_id (Text): Identification number for the device. See the computerId property of the device details returned by the following functions: 

• Get device by GUID
• Search devices

• result (bool): True if the request was successful, False if otherwise
• error (str): Information on the failure, or None

 Exception if the function cannot connect to Code42. 

Code42: Download file from backup

This function downloads a file stored in a backup archive and attaches it to the IBM Resilient incident.

• code42_path (Text):  File path for the file you want to download
  • Case insensitive 
  • Requires forward slashes "/" (including for Windows)
  • Enter only one path (file or directory) 
  • Windows examples: 
    • C:/Documents/Newsletters/Summer2018.pdf
    • C:/Users/cbarrett/Documents/Receipts
  • Mac examples:
    • /Users/marlena.pawlak/Documents/315Notes.docx
    • /Users/thomas.black/Desktop
• code42_device_guid (Text): Globally unique identifier for the device from which you want to download the file
  • See the guid property of the device details returned by the Search devices function. 
  • See the deviceUid property of the device details returned by the Search file events function. 
• incident_id (Number): Identification number of the IBM Resilient incident  
• Optional: code42_destination_guid (Text):  Globally unique identifier of the storage destination. See the targetComputerGuid  property in the device details returned by the Search devices function. 

• result (bool): True if the file was successfully attached to the incident, False if otherwise
• error (str): Information on the failure, or None

Exception if the function cannot connect to Code42. ​

Code42: Get user by username

This function obtains the user details from a given username. 

code42_username  (Text): The Code42 login name for the user.

• result (dict): User details. See the Example Response Body in the API Documentation for output syntax. 
• error (str): If result is None, information on the cause of the error.

Exception if the function cannot connect to Code42. ​

Code42: Reactivate device

This function activates a device that had been previously deactivated.

code42_device_id (Text): Identification number for the device. See the computerId property of the device details returned by the following functions: 

• Get device by GUID
• Search devices

• result (bool): True if the request was successful, False if otherwise
• error (str): Information on the failure, or None

 Exception if the function cannot connect to Code42. 

Code42: Reactivate user

This function activates a Code42 user who had been previously deactivated. The user's archives are moved out of cold storage. Learn more about reactivating users.

code42_user_id  (Text): Identification number for the user. See the userId property of the user details returned by the following functions: 

• Get user by username
• Get user by UID
• Search users

• result (bool): True if the request was successful, False if otherwise
• error (str): Information on the failure, or None

Exception if the function cannot connect to Code42.

Code42: Search devices

This function searches for a device by a given user ID and/or hostname.

• code42_device_user_uid  (Optional, Text): The user's unique identifier.  See the user_uid in the user details returned by the Get user by username function. 
• code42_hostname (Optional, Text): Either the name assigned to a device by Code42, the name of the device as reported by the operating system, or the globally unique identifier of the device. 

• result  (list): List of devices. See the Example Response Body in the API Documentation for syntax. 
• error (str): If result is None, information on the cause of the error.

Exception if the function cannot connect to Code42.

Code42: Search file events

This function runs a file event query using Code42 Forensic Search, for example based on filename, file hash, and/or username. This function facilitates requests with "AND" conditions.

• code42_md5_hashes (Text): See MD5 Hash in the Forensic Search reference guide. To use multiple values, separate them with a pipe "|" character.
• code42_sha256_hashes (Text): See SHA256 Hash in the Forensic Search reference guide. To use multiple values, separate them with a pipe "|" character.
• code42_hostnames (Text): See Hostname in the Forensic Search reference guide. To use multiple values, separate them with a pipe "|" character.
• code42_usernames (Text): See Username (Code42) in the Forensic Search reference guide. To use multiple values, separate them with a pipe "|" character.
• code42_filenames (Text): See Filename in the Forensic Search reference guide. To use multiple values, separate them with a pipe "|" character.
• code42_file_paths (Text): See File Path in the Forensic Search reference guide. To use multiple values, separate them with a pipe "|" character.
• code42_public_ip_addresses (Text): See IP Address (public) in the Forensic Search reference guide. To use multiple values, separate them with a pipe "|" character.
• code42_private_ip_addresses (Text): See IP Address (private) in the Forensic Search reference guide. To use multiple values, separate them with a pipe "|" character.
• code42_exposure_only (Boolean): See Exposure Type in the Forensic Search reference guide. 
• code42_on_or_before (Number): See Date Selector in the Forensic Search reference guide. Use UNIX Epoch time.
• code42_on_or_after (Number): See Date Selector in the Forensic Search reference guide. Use UNIX Epoch time.

• result (dict):
  • file_events (list): File events (up to 100*) matching the query. See the Example Value in the API Documentation for syntax. 
  • total_count (int): Number of file events matching the query.  
• error (str): If result is None, information on the cause of the error.

Exception if the function cannot connect to Code42.

*If the total count is over 100, use Code42 Forensic Search to view all the results.

Code42: Unblock device

This function re-enables access to Code42 on the device. Learn more about unblocking devices.

code42_device_id (Text): Identification number for the device. See the computerId property of the device details returned by the following functions: 

• Get device by GUID
• Search devices

• result (bool): True if the request was successful, False if otherwise
• error (str): Information on the failure, or None

Exception if the function cannot connect to Code42.

Code42: Unblock user

This function restores a user's access to Code42. Learn more about unblocking users.

code42_user_id (Text): Identification number for the user. See the userId  property of the user details returned by the following functions: 

• Get user by username
• Get user by UID
• Search users

• result (bool): True if the request was successful, False if otherwise
• error (str): Information on the failure, or None 

Exception if the function cannot connect to Code42.