Code42 cloud release notes

Confirm macOS full disk access status

October 19, 2020

Apple privacy restrictions require that you grant Code42 full disk access on user devices to enable security monitoring and backup activity for all files on the device. To help identify if devices have the required permissions, we've introduced two ways to confirm the full disk access status on a device: 

• For an individual device: In the Code42 app, enter the Code42 command fullDiskAccess.
• For all devices in an organization: See our Code42 API tutorial for viewing full disk access status.

Requires Code42 app version 8.2 or later

Destination categories for file uploads

October 19, 2020

File event details in Forensic Search and Cases now include Destination Category and Destination Name fields to better categorize where a user sent a file. For example, it's now easier to search for all files sent via email, or to search specifically only for files sent via Gmail. This enables you to better focus your investigations on higher risk file activity in unsanctioned locations.

Configure macOS permission notifications

October 16, 2020

Beginning with Code42 app version 8.5, the Code42 app checks to ensure it has the full disk access permissions required to monitor and back up all files on Mac devices. For devices with missing permissions, the Code42 console enables you to show or hide a warning message for users in the Code42 app.

New alert rule to monitor filenames and extensions

October 7, 2020

The new Filename or extension rule notifies you about exfiltration activity involving files with specific filenames, extensions (such as TAR, ZIP, or CPP), or words within a filename (such as "forecast" or "sales"). This rule is automatically triggered when files that match the name criteria are:

• Moved to removable media or cloud sync folders
• Read by a browser or app
• Made publicly accessible in cloud services
• Shared outside of the domains you trust 

You can enter multiple lines in one rule to monitor several different filenames or use wildcards to define common patterns in filenames to watch for.

October 21, 2020

• Performance and stability improvements.
• Fixed an issue with the email invitation for new users to register with Code42 where attempting to complete the registration form could result in the error message invite_error_SYSTEM.
• Fixed an issue where older versions of a file were not visible in the Restore files view under certain circumstances. (Older versions were still available to restore via direct search, just not by navigating to the file via the parent directory.)
• Improved error messaging when adding a new authentication provider via Identity Management > Authentication if the metadata file is too large or uses invalid parameters. 
• Fixed an issue where the Code42 console search and User Backup Report did not return results for users with apostrophes in their email addresses.
• Fixed an issue on the Create New Customization Template screen where the links to View an example did not properly display the sample images.
• Fixed an issue where navigating away from Forensic Search results to other Code42 console screens and then back to Forensic Search displayed the most recently-issued search. Now, Forensic Search correctly displays a new search.
• Fixed a legal hold issue where releasing a custodian who was previously deactivated in Code42 did not properly deactivate the user under certain circumstances. 

September 23, 2020

• Performance and stability improvements.
• Fixed an issue in which Directory Sync Reports were emailed to all users with the Customer Cloud Admin role. Now, reports are only sent to users who also have the Alert Emails role.
• Fixed an issue in which the cold storage purge date could not be changed for archives with multiple backup sets.
• On Mac devices, fixed a rare issue in which adding /Volumes to the list of backup exclusions could cause an error when trying to change the backup file selection or select files to restore.
• Fixed an issue in which a user with an apostrophe in their email address could not be created or edited under certain circumstances.
• When editing client delay settings, you can no longer remove the selected organization. Instead, you must select a different organization. This prevents an "unexpected error" when attempting to save a delay without specifying an organization. 
• When adding a client delay for a specific organization, fixed an issue in which text could not be entered in the search box. 
• In Code42 federal environments:
  • Fixed an issue in which files from a deleted backup set could appear in search results when attempting to restore files, even though the files are no longer available to restore. 
  • Fixed an issue in which files with multiple versions could not be downloaded from Forensic Search.
• Updates to Forensic Search:
  • Fixed a very rare issue in which saved searches didn't load properly. 
  • After creating a saved search, fixed an issue in which the link in the confirmation message incorrectly opened the Risk Exposure dashboard instead of the newly-created search.
  • Improved error messaging when attempting to add a duplicate event to a Case.
  • File downloads for printed file events are now properly restricted to only users with either the Customer Cloud Admin or Security Center - Restore role.
  • Updates to translations.
  • Security updates.

September 14, 2020

In Forensic Search:

• Navigating away from search results to other Code42 console screens and then back to Forensic Search now correctly displays a new search. Previously, the most recently-issued search re-appeared. 
• Fixed two minor styling issues in the Safari web browser when adding a file event to a case. 

Early access: Case management for security investigations

August 31, 2020

A new Cases interface in the Code42 console helps you manage security investigations with tools that collect, organize, and retain user file activity.

Specifically, Cases enables you to:

• Assemble evidence related to an investigation
• Add notes to provide additional context
• Summarize and share findings with others in your organization

For more details, see Create and edit cases.

Early access: View Forensic Search events in the Code42 Audit Log

August 26, 2020

The Code42 console added the Audit Log, a record that shows events in your Code42 environment. While in early access, the Audit Log is limited to Forensic Search events. To access the Audit Log, navigate to Reporting > Audit Log.  

You can filter events in the Audit Log by username, date, and IP address, as well as export the results in comma-separated values (CSV) format. You can also use the Code42 API to export Audit Log events in CSV, CEF, or JSON format for import into your internal security team tools. The Audit Log records events for the last 90 days, but to maintain Audit Log output for a longer period, you can export the results to your own systems for storage. While there is no limit to the number of events recorded in the Audit Log, the maximum number of events that can be viewed or exported at once is 10,000. 

Better control over delayed client upgrades

August 19, 2020

The Client Updates settings now offer additional options for customizing when Code42 app upgrades occur on user devices. Enhancements include: 

• Ability to set a one-time delay to deploy a specific Code42 app version on a specific date.
• Ability to block a specific Code42 app version from ever being deployed to user devices. To request a block, contact our Customer Champions for support.
• Organization Exceptions are renamed Recurring Delay to more clearly indicate the selected organization always receives new Code42 app versions after a specified delay.
• The existing Global delay setting is unchanged and continues to provide the option to define a delay for your entire Code42 environment.

New roles for managing detection lists

August 19, 2020

New Departing Employee Manager and High Risk Employee Manager roles enable you to grant more granular permissions for application integrations that add and remove users from the Departing Employees and High Risk Employees lists.

New Code42 Insider Threat app for Splunk

August 18, 2020

A new Code42 Insider Threat app for Splunk is now available. This app adds Code42-specific dashboards to Spunk that show file exposure activity, which can help you identify insider risk. The previous Code42 app for Splunk is now listed as "Legacy," but remains available for customers already using it.

Username details for cloud sync activity

August 6, 2020

Synced to cloud service events now capture the name of the user signed in to the cloud sync application on the device. This enables you to identify the specific account connected to the sync destination. For example, you can now identify if a file synced with Google Drive is being stored in your corporate G Suite, or in an unsanctioned personal Google account.

• In Forensic Search, use the new Sync username field to filter search results and provide additional context to file events. 
• Synced to cloud service events are now evaluated against your list of Trusted domains. Activity from users on domains you trust is excluded from Code42 dashboards and alerts. This reduces noise and helps you focus on higher-risk activity.

August 19, 2020

• Performance and stability improvements.
• Fixed an issue in which settings changed in the Code42 console could take an unexpectedly long time to apply to a single user with many devices.
• Fixed an issue in which the /scim-server/apply-configuration-to-users API incorrectly applied role assignment mapping changes to local users. (Local users are exempt from SCIM management.)

August 17, 2020

In Forensic Search:

• Fixed an issue in which removing a search filter could cause the remaining search filters to have incorrect values.
• Fixed an issue in which searches with the Exposure Type value exists or does not exist did not display properly after refreshing the page or when accessing the search via a direct URL.

August 6, 2020

• Fixed an issue in which file events on subdomains were considered trusted if the list of Trusted domains contained the "parent" domain without a wildcard (*). For example, now you must enter *.example.com to also trust activity on subdomains like sub.example.com. Before, entering example.com (with no leading wildcard) trusted both the "parent" domain and any subdomains.

Improved visibility of files shared in cloud services

July 29, 2020

• On the User Profile and Risk Exposure dashboard, a new Cloud sharing tab improves visibility of file sharing permission increases. Permission increases occur when files are shared publicly.​​ 

AirDrop file exflitration detection

July 22, 2020

For Mac devices, AirDrop is now included in the list of browsers and other applications monitored for file exfiltration. 

• In Forensic Search, AirDrop activity is indicated by the process name /usr/libexec/sharingd in the Exposure > Executable Name field.
• In dashboards and other places that report browser activity, AirDrop is included in the totals for Read by browser or other app activity.

Email notifications for administrator access changes

July 22, 2020

To provide better visibility into who has administrator permissions and to help you identify potential unauthorized access, Code42 administrators now receive email notifications when:

• Code42 Support Access is granted or removed.
• An administrator role is added to a user, both for existing user permission changes and for new user creation. 

July 22, 2020

• Performance and stability improvements.
• In the Code42 console:
  • Improved messaging to explain that sending limits cannot be changed for individual devices if the setting is locked at the organization level. 
  • Fixed an issue that could cause an error message to occur while scrolling through a list of devices.
  • Fixed an issue in which clicking Save in the Device Backup Default Settings screen did not close the window under certain circumstances.
  • On the Investigation > Activity Notifications screen, fixed a translation issue which prevented the Learn more about migrating alerts link from appearing for non-English languages.

June 17, 2020

• Performance and stability improvements. 
• Fixed an issue in which changes could not be saved to existing client customization templates.
• In child organizations that do not inherit settings from the parent organization, fixed an issue in which changed settings did not save properly when User Profile Backup (USMT) is enabled for the parent organization but not for the child organization. 
• Fixed an issue in which sort arrow icons incorrectly appeared in the column headings of the Last Backup Activity and Stored columns in the Devices list. These columns are not sortable.
• Fixed an issue in which selecting Administration > Settings > Keystore collapsed the Administration section of navigation menu and expanded the Investigation section. While the Keystore page did remain on the screen, the menu navigation no longer matched the active window.
• Fixed a rare intermittent issue in which backup storage statistics and graphs could incorrectly report 0 MB backed up. This was a display issue only; backup archive integrity was not affected.
• Improvements to logging.

June 15, 2020

• On the Risk Exposure dashboard, fixed an issue in which clicking the Investigate in Forensic Search   icon did not load the correct search results under certain circumstances.

Trusted domain filtering expanded to dashboards, alerts, and more

May 18, 2020

Domains on your list of Trusted domains now apply to more than just Forensic Search results: 

• File events on the Risk Exposure dashboard, Departing Employee and High Risk Employee lists, User Profiles, and in Alert notifications are now automatically filtered to only show events outside your trusted domains.
• A new Trusted Activity filter in Forensic Search lets you easily include or exclude results for endpoint and email activity on trusted domains.
• For Read by browser or other app events, trusted domain filtering now also applies to the Tab/Window Title and Tab URL fields.

This helps you focus investigations on higher-risk activity by filtering out events for domains you trust.

Remote file activity detection by IP address

May 18, 2020

Data Preferences in the Code42 console now includes a new tab to define your in-network IP addresses. Listing your in-network IP addresses enables Code42 to label activity from any IP address not on this list as remote activity, and lets you customize search results and dashboards to include in-network activity, remote activity, or both. 

To view remote activity:

• In Forensic Search, add the Remote Activity filter. In the file event details, remote events include a Remote activity label in the IP Address (public) field.
• In Alert notifications, look for the Remote activity label next to the IP address.
• On the Risk exposure dashboard:
  • In the Top file activity section, click View by remote activity.
  • Click the Remote activity tab within the All activity view.

Early access: Printer activity detection

May 5, 2020

On Mac and Linux devices, Code42 now detects files sent to printers. Once you enable print detection, print events are searchable in Forensic Search and you can download images of printed files. Monitoring printer activity gives you visibility into one more method of possible file exfiltration. Requires Code42 app version 8.0.0.

May 20, 2020

• Performance and stability improvements.
• Fixed several slow page load issues. It is now much faster to:
  • Edit a user's details 
  • Edit an organization's details
  • Load pages after making multiple settings updates 
• Fixed an issue in which the Administration > Organizations > Deactivated page did not properly load in Code42 environments with a very large number of deactivated organizations.
• On the Identity Management > Provisioning screen, fixed an issue for narrow browser windows in which very long passwords did not display properly or provide the option to Copy to clipboard.
• Improved error messaging for failed imports of identity provider XML metadata to better to describe the error and to provide a suggested resolution.
• Updates to First Name, Last Name, and Email initiated by an authentication provider are now included in the Code42 Sync Log. 
• On the Organization details screen, fixed a display issue in which very long organization names could be truncated with an ellipsis (…), making it difficult to determine exactly where a child organization existed in the organizational hierarchy. Now, long names wrap to additional lines. 
• Fixed an issue in which attempting to reactivate a device resulted in an unexpected error message under certain circumstances.
• Fixed an issue in which two-factor authentication for local users could not be enabled for users with passwords containing certain non-alphanumeric characters.

Manage access for Code42 support users

April 27, 2020

The Code42 console adds a new control for you to manage permissions for Code42 "support" users. A support user is a user account created by a Code42 Customer Champion in response to a support ticket. This allows Code42 to temporarily access your environment for the purpose of troubleshooting. To configure settings, navigate to Administration > Settings > Code42 Support Access. 

Early access: Visual risk indicators for anomalous behavior

April 23, 2020

The User Profile now adds a risk indicator icon  to file activity that may indicate greater risk, such as activity during hours when a user is not typically active or when file contents do not match the file extension. This enables you to better prioritize which file activity to investigate: 

• Off hours - Categorizes file activity that occurs at times a user is not typically active as an added risk. The off hours determination is unique to each user and based on the user's past patterns of behavior on their endpoint. This enables you to focus investigations on unusual file activity.
• File mismatch - Highlights file activity where files have extensions that do not match the file contents as an added risk. File mismatch determinations are shown for both endpoint and cloud file activity. This allows you to more quickly investigate anomalous file activity.

Early access: Off hours risk indicator in Forensic Search

April 23, 2020

The Risk Indicator filter in Forensic Search adds a new option to search for Off hours file activity. The off hours determination is unique to each user and is based on the user's past patterns of behavior. This enables you to focus investigations on unusual file activity that may indicate greater risk.

Early access: New Suspicious file mismatch alert rule

April 17, 2020

Code42 adds a new Suspicious file mismatch alert rule to notify you when activity is detected for a file with an extension that doesn't appear to match its contents—for example, when the file's contents indicate that the file is a ZIP file, but it has a PNG extension. This rule is automatically triggered for endpoint or cloud share permissions exposures.  

Early access: Filter by risk indicators in Forensic Search

April 10, 2020

Forensic Search adds a new search filter and a risk indicator icon  to highlight file activity that may indicate greater risk, such as a file extension that does not match the file contents. This enables you to better prioritize which file activity to investigate, and may indicate an attempt to disguise and exfiltrate data. 

April 30, 2020

• In Forensic Search, improved messaging if a file is not available for download. Previously, an incorrect message appeared in some situations indicating the device was not backing up to Code42, even though it was backing up. Now, the messaging correctly explains the reason the file is unavailable. 

April 16, 2020

• Improved error messaging if you enter only one character in the Code42 console search box.
• Improved logging for a rare circumstance in which the Code42 app is unable to connect to the Code42 cloud.
• Fixed an issue on the Code42 console sign-in page in which translations for some non-English languages did not display properly.
• For Code42 environments using Okta as the authentication provider, fixed an issue in which deactivating a user in Okta did not properly deactivate the Code42 user, under certain circumstances.

Greater visibility into file activity of employees working from home

March 20, 2020

Code42's new remote employee view provides organization-wide visibility into file activity on removable media, in cloud sync folders, and browser uploads for remote workers. The Detection > Risk Exposure dashboard enables you to:

• Quickly identify suspicious file activity over the past 90 days for employees working from home
• Easily review both endpoint and cloud sync file activity
• Detect organization-wide usage of Dropbox, iCloud, Box, OneDrive and Google Drive

Code42 app for Demisto now available

March 19, 2020 

The Code42 app for Demisto (now Cortex XSOAR) is now available. Using the Code42 app for Demisto, you can view and search Code42 data in Demisto, as well as manage Code42 Departing Employees from Demisto. 

Code42 CLI tool now available for SIEM integration

March 18, 2020

The Code42 command-line interface (CLI) tool offers a way to extract Code42 data for use in a security information and event management (SIEM) tool like LogRhythm, Sumo Logic, or IBM QRadar. Use this command-line interface tool to get the security events in either a JSON or CEF format for use by your SIEM tool. 

Early access: Code42 federal environment now available

March 12, 2020

The new Code42 federal environment is now available. This environment offers the same high level of security as all Code42 environments to government agencies in compliance with FedRAMP requirements.

The Federal Risk and Authorization Management Program (FedRAMP) from the United States Government provides a standard method for the security assessment, authorization, and continual monitoring of cloud products and services. Government agencies (and companies who partner with them) are required to choose FedRAMP authorized providers when using cloud products and services to ensure the security of their data. The Code42 federal environment is one such solution for organizations seeking a FedRAMP authorized service to protect against insider threat and data loss.

Government agencies can request access to the Code42 security package using the request form available on the FedRAMP marketplace. To access the form, select Code42 from the marketplace list and then click the Package Access Request Form link. More information is also available at https://www.code42.com/go/federal-solutions.

March 19, 2020

• Performance and stability improvements.
• In Code42 environments with an on-premises authority server that use Code42 cloud storage, fixed an issue which could prevent devices from being able to connect to the Code42 cloud under a very specific set of network port configuration circumstances.
• Authentication and directory services settings now properly inherit values from the parent organization by default.
• Fixed an issue in which attempting to search for a GUID in the administration console returned an error.
• Fixed an issue for Code42 environments using SCIM provisioning: deleting a SCIM group now applies the default Code42 roles (Desktop User and PROe User) to any users in that group. Previously, the role mapping defined by the deleted group remained in place.
• Fixed a rare display issue in which the web restore date picker could continue to appear at the bottom of the administration console after navigating to a different page.
• Fixed an issue in which restoring files from the administration console could fail if you selected a folder to restore and then deselected sub-folders within the selected folder.

Video summary

Watch the short video below for a summary of features released this month.

Greater visibility into file activity of high risk employees

February 19, 2020

Code42's new High Risk Employee lens provides comprehensive insight into file activity of employees you identify as a risk (for example, users with elevated permissions, access to sensitive data, on a performance improvement plan, etc.). The Detection > High Risk Employees section of the administration console enables you to: 

• Quickly identify suspicious file activity of high risk employees over the past 90 days
• Assign risk factors to employees to provide more context for insider threat investigations
• Easily review both endpoint and cloud sync file activity

Forensic File Search now searches backups from all users to locate and download file contents

February 12, 2020

When downloading file contents in Forensic File Search, the file event details now offers the option to search other locations if the file isn't found in the user's backup archive. Clicking Search Other Locations searches the backups of all users in your Code42 environment, which greatly increases the chance the file will be available for download. Previously, files could only be downloaded if there was an exact filename and file path match in the backup archive of the user associated with the event.

More subscription options for monitoring insider threats

February 11, 2020

The Code42 Diamond product plan offers a new subscription option for many of Code42's most advanced insider threat features, including:

• The Risk Exposure dashboard, which highlights suspicious file activity
• A highly customizable Alerts framework to notify you when when important data may be leaving your organization
• The powerful Forensic Search interface, which offers advanced search capabilities for investigating file exfiltration activity

Previously, some of this information was available via a CSV export, but full access to these features required the Code42 Platinum product plan. 

Requires Code42 app version 7.7.0.

Use one deployment policy to register users in multiple organizations

February 11, 2020

Deployment policies can now leverage custom user detection scripts that dynamically assign users to different organizations. Previously, deployment policies could only register users to a single organization.

Requires Code42 app version 7.7.0.

February 19, 2020

• Security updates.
• Performance and stability improvements.
• Fixed an issue in which the text-only version of the backup status report email displayed some fields incorrectly. 
• In Code42 environments with an on-premises authority server also using Code42 cloud storage, fixed a rare issue in which backup storage statistics did not update properly.
• Fixed a rare issue in which clicking the link in an activity notification email to view user activity did not display any results.

Video summary

Watch the short video below for a summary of features released this month.

Endpoint dashboard provides visibility for devices not reporting security events

January 30, 2020

A new Endpoint dashboard identifies user devices not sending file event data to Forensic File Search. This improved visibility can help you troubleshoot specific devices to ensure Code42's security monitoring is capturing file activity on all active devices in your Code42 environment.  

Better visibility into endpoint and cloud services file activity for all users

January 30, 2020

A new User Profile search interface provides comprehensive insight into file exfiltration risk for all users. The Investigation > User Activity section of the administration console now enables you to review both endpoint and cloud sync file activity for the last 90 days to quickly identify suspicious file activity. 

Previously, much of this information was only available for users added to a departing employee profile or via CSV export.

Requires the Code42 Platinum product plan.

Sync destinations added to Risk Exposure dashboard

January 27, 2020

The Risk Exposure dashboard now shows you where employees are syncing files. By reviewing the Synced to Cloud Service details, you can quickly see if users are syncing files to unapproved cloud services. 

Forensic File Search adds search filter for files shared with trusted domains

January 17, 2020

Trusted Domains settings enable you to easily exclude files shared with approved domains from search results in Forensic File Search.

To use the new search filter:

• Add domains you trust to Administration > Settings > Trusted Domains.
• From Investigation > Forensic Search, add the Exposure Type filter to your search criteria and select the value Outside trusted domain.

File categories added to Alerts 

January 16, 2020

You can now add file category filters to Alerts to help you more easily determine what types of files (spreadsheets, zip files, source code, and multimedia, for example) are leaving your organization. 

Sync destinations added to Departing Employees lens

January 13, 2020

The Departing Employees lens now shows you where employees are syncing files. By reviewing the sync destination details, you can quickly see if users are syncing files to unapproved cloud services. 

Risk Exposure dashboard highlights departing employee activity

January 2, 2020

The Risk Exposure dashboard now includes a summary of potential exposure events gathered from the Departing Employees lens. Click any value for more details.

January 29, 2020

• Performance and stability improvements.
• Fixed: The Administration > Organizations screen now loads much faster for Code42 environments with many child organizations.
• Fixed a web restore issue: filenames containing apostrophes now properly appear in search results. Previously, searching for a filename containing an apostrophe could return no results even if the file was backed up and available to restore. 
• Fixed: Exporting organization details to CSV now reports correct values for selectedFiles, totdoBytes and todoFiles. Previously, these fields could incorrectly report zero or null under certain circumstances even though there were files selected for backup.
• Improvements to logging.
• Fixed: Two-factor authentication for local users can now be enabled if a user's password contains special characters.
• Fixed: Using the action menu to block or unblock a user now immediately updates the status icon next to that user. Previously, even though the blocking or unblocking succeeded, refreshing the page was required to see the current status for the user.
• For Code42 environments managing their own external keystore, connection failures now display more specific error messaging on the Administration > Settings > Keystore page and in the logs.
• Fixed an intermittent display issue which could cause page styles to render incorrectly when navigating between specific screens in the administration console.
• Updates to translations.

January 8, 2020

• Fixes an issue in which downloading files from Forensic File Search was not available in the Safari web browser.
• Improves error messaging if File Size search criteria is blank.