Usernames are missing from Google Drive "Shared with users" lists
Overview
The Code42 data connection automatically filters the list of users a file is shared with in Google Drive to exclude any username that is not an email address. When this filtering occurs, usernames can be missing from "Shared with users" lists. Such usernames are typically associated with service or integration accounts with sharing permissions in your Google environment instead of end users, and generally aren't useful for investigating file events.
While these usernames may appear in Google Drive, Code42 only displays user names that are email addresses in "Shared with users" lists in Forensic Search or alert notifications.
Resolve when usernames are missing from "Shared with users" lists
If legitimate users are missing from "Shared with users" lists, examine the list of people or groups who have been assigned to that drive in your Google environment. Then, use one of these methods to adjust that user list as needed:
- In Google Drive:
- Verify that the users assigned to the drive are all associated with appropriate email addresses.
- Add a user that is in scope for monitoring as a member of that shared drive.
- Reconfigure scoping in Code42 to add one or more members of that drive as users that are in scope for monitoring.