Code42 cloud release notes

Code42 Developer Portal

January 11, 2021

The Code42 Developer Portal is a new resource site for those who want to write scripts to automate Incydr tasks and set up integrations. 

Benefits of the portal include:

• A single access point for documentation of methods for Incydr, including Code42's REST API, Python SDK py42, and command-line interface (CLI)
• A single request URL for Code42 API calls to each cloud instance
• Code42 API reference documentation as well as articles that describe how to use the APIs
• Open-source contributions to the portal using GitHub

Recommended rule templates in Alerts

December 9, 2020

Alerts adds new pre-configured, recommended rule templates. These templates allow you to quickly create rules from common default settings that you can modify as needed for your environment. 

Export case data

December 9, 2020

Cases now provides the option to export and download case details to PDF and CSV files. This enables you to more easily share case data with others in your organization.

Improved Code42 console navigation

December 8, 2020

The redesigned Code42 console navigation menu now appears across the top of the screen, instead of on the left.

Benefits of this update include:

• Enhanced usability and organization
• A more compact design increases the usable viewing area for all Code42 console screens

Most items have the same name and relative hierarchy within each top-level menu. However, some items changed names or appear in new places. See Changes to the Code42 console navigation for complete details. 

Automated integrations

November 13, 2020

Code42 automated integrations provide an option for automating systems and workflows, which Code42 manages and monitors. These integrations can help speed your processes for detecting, investigating, and responding to insider risks. For example, you might choose to connect systems as follows: 

• When an alert is triggered in Code42, a ticket is automatically opened in a system like ServiceNow.
• Automatically add users to the Departing Employees list based on updates to information in your human resources system, such as Workday or ADP.
• When an alert is triggered in Code42 for a departing employee, a user is added to a specific Okta group with lower permissions. Then, a ticket is opened in Jira with alert details for further investigation by your security team.

For more information, see Configure automated integrations. 

Improved trusted domain support for OneDrive

November 5, 2020

The Microsoft OneDrive cloud data source now uses the same list of trusted domains as all other data sources and exposure events. This means:

• The Trusted Domains for OneDrive setting is no longer needed and was removed from the Data Preferences > Trusted Domains tab.
• For files shared outside your OneDrive instance to be categorized as Outside trusted domains, you must add at least one entry to the list of trusted domains.

Previously, the only domain you could configure to trust was your internal OneDrive instance and your list of trusted domains was not applied to OneDrive events.

November 19, 2020

• For the Box and OneDrive cloud data sources, fixed an issue where the Actor reported in Forensic Search may not represent the user who made a sharing permission change. Previously, Code42 identified the Actor as the last user to update a file’s contents, which may not have accurately reflected who changed its sharing permissions. Now, Code42 correctly identifies the Actor who made a sharing permission change that increased exposure.

November 18, 2020

• Improves Code42 console responsiveness when multiple device settings updates are being pushed to user devices.
• In Code42 environments with an on-premises authority server using Code42 cloud storage, fixed an issue where administrators were unable to reset archives. 
• Fixed a rare issue where Code42 console search results could incorrectly show 0 results for a search term with at least one match.
• For Code42 environments with Advanced Settings enabled for Client Updates, the list of versions to block now correctly lists the three most recent versions. Previously, only two versions appeared.
• Apostrophes in users' names are now consistently formatted as single quotes ('). This fixed an issue where it was possible for the first and last name fields to use an apostrophe or "smart quote" while the email address used a single quote. This could cause inconsistent search results. 
• Fixed an issue where attempting to map an Azure SCIM group with no members to a Code42 organization caused an error. 

November 3, 2020

• In Forensic Search, fixed an issue where file events with more than one Exposure Type only displayed a single value under certain circumstances. 

Confirm macOS full disk access status

October 19, 2020

Apple privacy restrictions require that you grant Code42 full disk access on user devices to enable security monitoring and backup activity for all files on the device. To help identify if devices have the required permissions, we've introduced two ways to confirm the full disk access status on a device: 

• For an individual device: In the Code42 app, enter the Code42 command fullDiskAccess.
• For all devices in an organization: See our Code42 API tutorial for viewing full disk access status.

Requires Code42 app version 8.2 or later

Destination categories for file uploads

October 19, 2020

File event details in Forensic Search and Cases now include Destination Category and Destination Name fields to better categorize where a user sent a file. For example, it's now easier to search for all files sent via email, or to search specifically only for files sent via Gmail. This enables you to better focus your investigations on higher risk file activity in unsanctioned locations.

Configure macOS permission notifications

October 16, 2020

Beginning with Code42 app version 8.5, the Code42 app checks to ensure it has the full disk access permissions required to monitor and back up all files on Mac devices. For devices with missing permissions, the Code42 console enables you to show or hide a warning message for users in the Code42 app.

New alert rule to monitor filenames and extensions

October 7, 2020

The new Filename or extension rule notifies you about exfiltration activity involving files with specific filenames, extensions (such as TAR, ZIP, or CPP), or words within a filename (such as "forecast" or "sales"). This rule is automatically triggered when files that match the name criteria are:

• Moved to removable media or cloud sync folders
• Read by a browser or app
• Made publicly accessible in cloud services
• Shared outside of the domains you trust 

You can enter multiple lines in one rule to monitor several different filenames or use wildcards to define common patterns in filenames to watch for.

October 26, 2020

In Forensic Search:

• Fixed an issue where a search could not be saved if the Event Type was empty.
• Fixed several display and alignment issues with the Add to Case dialog.
• Fixed an issue introduced on October 19, 2020 with the Trusted Activity filter where setting the value to Exclude caused an unexpected error.

October 21, 2020

• Performance and stability improvements.
• Fixed an issue with the email invitation for new users to register with Code42 where attempting to complete the registration form could result in the error message invite_error_SYSTEM.
• Fixed an issue where older versions of a file were not visible in the Restore files view under certain circumstances. (Older versions were still available to restore via direct search, just not by navigating to the file via the parent directory.)
• Improved error messaging when adding a new authentication provider via Identity Management > Authentication if the metadata file is too large or uses invalid parameters. 
• Fixed an issue where the Code42 console search and User Backup Report did not return results for users with apostrophes in their email addresses.
• Fixed an issue on the Create New Customization Template screen where the links to View an example did not properly display the sample images.
• Fixed an issue where navigating away from Forensic Search results to other Code42 console screens and then back to Forensic Search displayed the most recently-issued search. Now, Forensic Search correctly displays a new search.
• Fixed a legal hold issue where releasing a custodian who was previously deactivated in Code42 did not properly deactivate the user under certain circumstances. 

October 12, 2020

• Fixed an issue where the High Risk Employees and Departing Employees badge remained after a user was removed from the lists via their User profile. The employee was removed from the list, but the badge remained.

October 5, 2020

• From the Endpoint dashboard, fixed an issue where exporting a list of endpoints not reporting security events resulted in an error.

September 23, 2020

• Performance and stability improvements.
• Fixed an issue in which Directory Sync Reports were emailed to all users with the Customer Cloud Admin role. Now, reports are only sent to users who also have the Alert Emails role.
• Fixed an issue in which the cold storage purge date could not be changed for archives with multiple backup sets.
• On Mac devices, fixed a rare issue in which adding /Volumes to the list of backup exclusions could cause an error when trying to change the backup file selection or select files to restore.
• Fixed an issue in which a user with an apostrophe in their email address could not be created or edited under certain circumstances.
• When editing client delay settings, you can no longer remove the selected organization. Instead, you must select a different organization. This prevents an "unexpected error" when attempting to save a delay without specifying an organization. 
• When adding a client delay for a specific organization, fixed an issue in which text could not be entered in the search box. 
• In Code42 federal environments:
  • Fixed an issue in which files from a deleted backup set could appear in search results when attempting to restore files, even though the files are no longer available to restore. 
  • Fixed an issue in which files with multiple versions could not be downloaded from Forensic Search.
• Updates to Forensic Search:
  • Fixed a very rare issue in which saved searches didn't load properly. 
  • After creating a saved search, fixed an issue in which the link in the confirmation message incorrectly opened the Risk Exposure dashboard instead of the newly-created search.
  • Improved error messaging when attempting to add a duplicate event to a Case.
  • File downloads for printed file events are now properly restricted to only users with either the Customer Cloud Admin or Security Center - Restore role.
  • Updates to translations.
  • Security updates.

September 14, 2020

In Forensic Search:

• Navigating away from search results to other Code42 console screens and then back to Forensic Search now correctly displays a new search. Previously, the most recently-issued search re-appeared. 
• Fixed two minor styling issues in the Safari web browser when adding a file event to a case. 

Early access: Case management for security investigations

August 31, 2020

A new Cases interface in the Code42 console helps you manage security investigations with tools that collect, organize, and retain user file activity.

Specifically, Cases enables you to:

• Assemble evidence related to an investigation
• Add notes to provide additional context
• Summarize and share findings with others in your organization

For more details, see Create and edit cases.

Early access: View Forensic Search events in the Code42 Audit Log

August 26, 2020

The Code42 console added the Audit Log, a record that shows events in your Code42 environment. While in early access, the Audit Log is limited to Forensic Search events. To access the Audit Log, navigate to Reporting > Audit Log.  

You can filter events in the Audit Log by username, date, and IP address, as well as export the results in comma-separated values (CSV) format. You can also use the Code42 API to export Audit Log events in CSV, CEF, or JSON format for import into your internal security team tools. The Audit Log records events for the last 90 days, but to maintain Audit Log output for a longer period, you can export the results to your own systems for storage. While there is no limit to the number of events recorded in the Audit Log, the maximum number of events that can be viewed or exported at once is 10,000. 

Better control over delayed client upgrades

August 19, 2020

The Client Updates settings now offer additional options for customizing when Code42 app upgrades occur on user devices. Enhancements include: 

• Ability to set a one-time delay to deploy a specific Code42 app version on a specific date.
• Ability to block a specific Code42 app version from ever being deployed to user devices. To request a block, contact our Customer Champions for support.
• Organization Exceptions are renamed Recurring Delay to more clearly indicate the selected organization always receives new Code42 app versions after a specified delay.
• The existing Global delay setting is unchanged and continues to provide the option to define a delay for your entire Code42 environment.

New roles for managing detection lists

August 19, 2020

New Departing Employee Manager and High Risk Employee Manager roles enable you to grant more granular permissions for application integrations that add and remove users from the Departing Employees and High Risk Employees lists.

New Code42 Insider Threat app for Splunk

August 18, 2020

A new Code42 Insider Threat app for Splunk is now available. This app adds Code42-specific dashboards to Spunk that show file exposure activity, which can help you identify insider risk. The previous Code42 app for Splunk is now listed as "Legacy," but remains available for customers already using it.

Username details for cloud sync activity

August 6, 2020

Synced to cloud service events now capture the name of the user signed in to the cloud sync application on the device. This enables you to identify the specific account connected to the sync destination. For example, you can now identify if a file synced with Google Drive is being stored in your corporate G Suite, or in an unsanctioned personal Google account.

• In Forensic Search, use the new Sync username field to filter search results and provide additional context to file events. 
• Synced to cloud service events are now evaluated against your list of Trusted domains. Activity from users on domains you trust is excluded from Code42 dashboards and alerts. This reduces noise and helps you focus on higher-risk activity.

August 19, 2020

• Performance and stability improvements.
• Fixed an issue in which settings changed in the Code42 console could take an unexpectedly long time to apply to a single user with many devices.
• Fixed an issue in which the /scim-server/apply-configuration-to-users API incorrectly applied role assignment mapping changes to local users. (Local users are exempt from SCIM management.)

August 17, 2020

In Forensic Search:

• Fixed an issue in which removing a search filter could cause the remaining search filters to have incorrect values.
• Fixed an issue in which searches with the Exposure Type value exists or does not exist did not display properly after refreshing the page or when accessing the search via a direct URL.

August 6, 2020

• Fixed an issue in which file events on subdomains were considered trusted if the list of Trusted domains contained the "parent" domain without a wildcard (*). For example, now you must enter *.example.com to also trust activity on subdomains like sub.example.com. Before, entering example.com (with no leading wildcard) trusted both the "parent" domain and any subdomains.

Improved visibility of files shared in cloud services

July 29, 2020

• On the User Profile and Risk Exposure dashboard, a new Cloud sharing tab improves visibility of file sharing permission increases. Permission increases occur when files are shared publicly.​​ 

AirDrop file exfiltration detection

July 22, 2020

For Mac devices, AirDrop is now included in the list of browsers and other applications monitored for file exfiltration. 

• In Forensic Search, AirDrop activity is indicated by the process name /usr/libexec/sharingd in the Exposure > Executable Name field.
• In dashboards and other places that report browser activity, AirDrop is included in the totals for Read by browser or other app activity.

Email notifications for administrator access changes

July 22, 2020

To provide better visibility into who has administrator permissions and to help you identify potential unauthorized access, Code42 administrators now receive email notifications when:

• Code42 Support Access is granted or removed.
• An administrator role is added to a user, both for existing user permission changes and for new user creation. 

July 22, 2020

• Performance and stability improvements.
• In the Code42 console:
  • Improved messaging to explain that sending limits cannot be changed for individual devices if the setting is locked at the organization level. 
  • Fixed an issue that could cause an error message to occur while scrolling through a list of devices.
  • Fixed an issue in which clicking Save in the Device Backup Default Settings screen did not close the window under certain circumstances.
  • On the Investigation > Activity Notifications screen, fixed a translation issue which prevented the Learn more about migrating alerts link from appearing for non-English languages.

June 17, 2020

• Performance and stability improvements. 
• Fixed an issue in which changes could not be saved to existing client customization templates.
• In child organizations that do not inherit settings from the parent organization, fixed an issue in which changed settings did not save properly when User Profile Backup (USMT) is enabled for the parent organization but not for the child organization. 
• Fixed an issue in which sort arrow icons incorrectly appeared in the column headings of the Last Backup Activity and Stored columns in the Devices list. These columns are not sortable.
• Fixed an issue in which selecting Administration > Settings > Keystore collapsed the Administration section of navigation menu and expanded the Investigation section. While the Keystore page did remain on the screen, the menu navigation no longer matched the active window.
• Fixed a rare intermittent issue in which backup storage statistics and graphs could incorrectly report 0 MB backed up. This was a display issue only; backup archive integrity was not affected.
• Improvements to logging.

June 15, 2020

• On the Risk Exposure dashboard, fixed an issue in which clicking the Investigate in Forensic Search   icon did not load the correct search results under certain circumstances.

Trusted domain filtering expanded to dashboards, alerts, and more

May 18, 2020

Domains on your list of Trusted domains now apply to more than just Forensic Search results: 

• File events on the Risk Exposure dashboard, Departing Employee and High Risk Employee lists, User Profiles, and in Alert notifications are now automatically filtered to only show events outside your trusted domains.
• A new Trusted Activity filter in Forensic Search lets you easily include or exclude results for endpoint and email activity on trusted domains.
• For Read by browser or other app events, trusted domain filtering now also applies to the Tab/Window Title and Tab URL fields.

This helps you focus investigations on higher-risk activity by filtering out events for domains you trust.

Remote file activity detection by IP address

May 18, 2020

Data Preferences in the Code42 console now includes a new tab to define your in-network IP addresses. Listing your in-network IP addresses enables Code42 to label activity from any IP address not on this list as remote activity, and lets you customize search results and dashboards to include in-network activity, remote activity, or both. 

To view remote activity:

• In Forensic Search, add the Remote Activity filter. In the file event details, remote events include a Remote activity label in the IP Address (public) field.
• In Alert notifications, look for the Remote activity label next to the IP address.
• On the Risk exposure dashboard:
  • In the Top file activity section, click View by remote activity.
  • Click the Remote activity tab within the All activity view.

Early access: Printer activity detection

May 5, 2020

On Mac and Linux devices, Code42 now detects files sent to printers. Once you enable print detection, print events are searchable in Forensic Search and you can download images of printed files. Monitoring printer activity gives you visibility into one more method of possible file exfiltration. Requires Code42 app version 8.0.0.

May 20, 2020

• Performance and stability improvements.
• Fixed several slow page load issues. It is now much faster to:
  • Edit a user's details 
  • Edit an organization's details
  • Load pages after making multiple settings updates 
• Fixed an issue in which the Administration > Organizations > Deactivated page did not properly load in Code42 environments with a very large number of deactivated organizations.
• On the Identity Management > Provisioning screen, fixed an issue for narrow browser windows in which very long passwords did not display properly or provide the option to Copy to clipboard.
• Improved error messaging for failed imports of identity provider XML metadata to better to describe the error and to provide a suggested resolution.
• Updates to First Name, Last Name, and Email initiated by an authentication provider are now included in the Code42 Sync Log. 
• On the Organization details screen, fixed a display issue in which very long organization names could be truncated with an ellipsis (…), making it difficult to determine exactly where a child organization existed in the organizational hierarchy. Now, long names wrap to additional lines. 
• Fixed an issue in which attempting to reactivate a device resulted in an unexpected error message under certain circumstances.
• Fixed an issue in which two-factor authentication for local users could not be enabled for users with passwords containing certain non-alphanumeric characters.

Manage access for Code42 support users

April 27, 2020

The Code42 console adds a new control for you to manage permissions for Code42 "support" users. A support user is a user account created by a Code42 Customer Champion in response to a support ticket. This allows Code42 to temporarily access your environment for the purpose of troubleshooting. To configure settings, navigate to Administration > Settings > Code42 Support Access. 

Early access: Visual risk indicators for anomalous behavior

April 23, 2020

The User Profile now adds a risk indicator icon  to file activity that may indicate greater risk, such as activity during hours when a user is not typically active or when file contents do not match the file extension. This enables you to better prioritize which file activity to investigate: 

• Off hours - Categorizes file activity that occurs at times a user is not typically active as an added risk. The off hours determination is unique to each user and based on the user's past patterns of behavior on their endpoint. This enables you to focus investigations on unusual file activity.
• File mismatch - Highlights file activity where files have extensions that do not match the file contents as an added risk. File mismatch determinations are shown for both endpoint and cloud file activity. This allows you to more quickly investigate anomalous file activity.

Early access: Off hours risk indicator in Forensic Search

April 23, 2020

The Risk Indicator filter in Forensic Search adds a new option to search for Off hours file activity. The off hours determination is unique to each user and is based on the user's past patterns of behavior. This enables you to focus investigations on unusual file activity that may indicate greater risk.

Early access: New Suspicious file mismatch alert rule

April 17, 2020

Code42 adds a new Suspicious file mismatch alert rule to notify you when activity is detected for a file with an extension that doesn't appear to match its contents—for example, when the file's contents indicate that the file is a ZIP file, but it has a PNG extension. This rule is automatically triggered for endpoint or cloud share permissions exposures.  

Early access: Filter by risk indicators in Forensic Search

April 10, 2020

Forensic Search adds a new search filter and a risk indicator icon  to highlight file activity that may indicate greater risk, such as a file extension that does not match the file contents. This enables you to better prioritize which file activity to investigate, and may indicate an attempt to disguise and exfiltrate data. 

April 30, 2020

• In Forensic Search, improved messaging if a file is not available for download. Previously, an incorrect message appeared in some situations indicating the device was not backing up to Code42, even though it was backing up. Now, the messaging correctly explains the reason the file is unavailable. 

April 16, 2020

• Improved error messaging if you enter only one character in the Code42 console search box.
• Improved logging for a rare circumstance in which the Code42 app is unable to connect to the Code42 cloud.
• Fixed an issue on the Code42 console sign-in page in which translations for some non-English languages did not display properly.
• For Code42 environments using Okta as the authentication provider, fixed an issue in which deactivating a user in Okta did not properly deactivate the Code42 user, under certain circumstances.

Greater visibility into file activity of employees working from home

March 20, 2020

Code42's new remote employee view provides organization-wide visibility into file activity on removable media, in cloud sync folders, and browser uploads for remote workers. The Detection > Risk Exposure dashboard enables you to:

• Quickly identify suspicious file activity over the past 90 days for employees working from home
• Easily review both endpoint and cloud sync file activity
• Detect organization-wide usage of Dropbox, iCloud, Box, OneDrive and Google Drive

Code42 app for Demisto now available

March 19, 2020 

The Code42 app for Demisto (now Cortex XSOAR) is now available. Using the Code42 app for Demisto, you can view and search Code42 data in Demisto, as well as manage Code42 Departing Employees from Demisto. 

Code42 CLI tool now available for SIEM integration

March 18, 2020

The Code42 command-line interface (CLI) tool offers a way to extract Code42 data for use in a security information and event management (SIEM) tool like LogRhythm, Sumo Logic, or IBM QRadar. Use this command-line interface tool to get the security events in either a JSON or CEF format for use by your SIEM tool. 

Early access: Code42 federal environment now available

March 12, 2020

The new Code42 federal environment is now available. This environment offers the same high level of security as all Code42 environments to government agencies in compliance with FedRAMP requirements.

The Federal Risk and Authorization Management Program (FedRAMP) from the United States Government provides a standard method for the security assessment, authorization, and continual monitoring of cloud products and services. Government agencies (and companies who partner with them) are required to choose FedRAMP authorized providers when using cloud products and services to ensure the security of their data. The Code42 federal environment is one such solution for organizations seeking a FedRAMP authorized service to protect against insider threat and data loss.

Government agencies can request access to the Code42 security package using the request form available on the FedRAMP marketplace. To access the form, select Code42 from the marketplace list and then click the Package Access Request Form link. More information is also available at https://www.code42.com/go/federal-solutions.

March 19, 2020

• Performance and stability improvements.
• In Code42 environments with an on-premises authority server that use Code42 cloud storage, fixed an issue which could prevent devices from being able to connect to the Code42 cloud under a very specific set of network port configuration circumstances.
• Authentication and directory services settings now properly inherit values from the parent organization by default.
• Fixed an issue in which attempting to search for a GUID in the administration console returned an error.
• Fixed an issue for Code42 environments using SCIM provisioning: deleting a SCIM group now applies the default Code42 roles (Desktop User and PROe User) to any users in that group. Previously, the role mapping defined by the deleted group remained in place.
• Fixed a rare display issue in which the web restore date picker could continue to appear at the bottom of the administration console after navigating to a different page.
• Fixed an issue in which restoring files from the administration console could fail if you selected a folder to restore and then deselected sub-folders within the selected folder.

Video summary

Watch the short video below for a summary of features released this month.

Greater visibility into file activity of high risk employees

February 19, 2020

Code42's new High Risk Employee lens provides comprehensive insight into file activity of employees you identify as a risk (for example, users with elevated permissions, access to sensitive data, on a performance improvement plan, etc.). The Detection > High Risk Employees section of the administration console enables you to: 

• Quickly identify suspicious file activity of high risk employees over the past 90 days
• Assign risk factors to employees to provide more context for insider threat investigations
• Easily review both endpoint and cloud sync file activity

Forensic File Search now searches backups from all users to locate and download file contents

February 12, 2020

When downloading file contents in Forensic File Search, the file event details now offers the option to search other locations if the file isn't found in the user's backup archive. Clicking Search Other Locations searches the backups of all users in your Code42 environment, which greatly increases the chance the file will be available for download. Previously, files could only be downloaded if there was an exact filename and file path match in the backup archive of the user associated with the event.

More subscription options for monitoring insider threats

February 11, 2020

The Code42 Diamond product plan offers a new subscription option for many of Code42's most advanced insider threat features, including:

• The Risk Exposure dashboard, which highlights suspicious file activity
• A highly customizable Alerts framework to notify you when when important data may be leaving your organization
• The powerful Forensic Search interface, which offers advanced search capabilities for investigating file exfiltration activity

Previously, some of this information was available via a CSV export, but full access to these features required the Code42 Platinum product plan. 

Requires Code42 app version 7.7.0.

Use one deployment policy to register users in multiple organizations

February 11, 2020

Deployment policies can now leverage custom user detection scripts that dynamically assign users to different organizations. Previously, deployment policies could only register users to a single organization.

Requires Code42 app version 7.7.0.

February 19, 2020

• Security updates.
• Performance and stability improvements.
• Fixed an issue in which the text-only version of the backup status report email displayed some fields incorrectly. 
• In Code42 environments with an on-premises authority server also using Code42 cloud storage, fixed a rare issue in which backup storage statistics did not update properly.
• Fixed a rare issue in which clicking the link in an activity notification email to view user activity did not display any results.

Video summary

Watch the short video below for a summary of features released this month.

Endpoint dashboard provides visibility for devices not reporting security events

January 30, 2020

A new Endpoint dashboard identifies user devices not sending file event data to Forensic File Search. This improved visibility can help you troubleshoot specific devices to ensure Code42's security monitoring is capturing file activity on all active devices in your Code42 environment.  

Better visibility into endpoint and cloud services file activity for all users

January 30, 2020

A new User Profile search interface provides comprehensive insight into file exfiltration risk for all users. The Investigation > User Activity section of the administration console now enables you to review both endpoint and cloud sync file activity for the last 90 days to quickly identify suspicious file activity. 

Previously, much of this information was only available for users added to a departing employee profile or via CSV export.

Requires the Code42 Platinum product plan.

Sync destinations added to Risk Exposure dashboard

January 27, 2020

The Risk Exposure dashboard now shows you where employees are syncing files. By reviewing the Synced to Cloud Service details, you can quickly see if users are syncing files to unapproved cloud services. 

Forensic File Search adds search filter for files shared with trusted domains

January 17, 2020

Trusted Domains settings enable you to easily exclude files shared with approved domains from search results in Forensic File Search.

To use the new search filter:

• Add domains you trust to Administration > Settings > Trusted Domains.
• From Investigation > Forensic Search, add the Exposure Type filter to your search criteria and select the value Outside trusted domain.

File categories added to Alerts 

January 16, 2020

You can now add file category filters to Alerts to help you more easily determine what types of files (spreadsheets, zip files, source code, and multimedia, for example) are leaving your organization. 

Sync destinations added to Departing Employees lens

January 13, 2020

The Departing Employees lens now shows you where employees are syncing files. By reviewing the sync destination details, you can quickly see if users are syncing files to unapproved cloud services. 

Risk Exposure dashboard highlights departing employee activity

January 2, 2020

The Risk Exposure dashboard now includes a summary of potential exposure events gathered from the Departing Employees lens. Click any value for more details.

January 29, 2020

• Performance and stability improvements.
• Fixed: The Administration > Organizations screen now loads much faster for Code42 environments with many child organizations.
• Fixed a web restore issue: filenames containing apostrophes now properly appear in search results. Previously, searching for a filename containing an apostrophe could return no results even if the file was backed up and available to restore. 
• Fixed: Exporting organization details to CSV now reports correct values for selectedFiles, totdoBytes and todoFiles. Previously, these fields could incorrectly report zero or null under certain circumstances even though there were files selected for backup.
• Improvements to logging.
• Fixed: Two-factor authentication for local users can now be enabled if a user's password contains special characters.
• Fixed: Using the action menu to block or unblock a user now immediately updates the status icon next to that user. Previously, even though the blocking or unblocking succeeded, refreshing the page was required to see the current status for the user.
• For Code42 environments managing their own external keystore, connection failures now display more specific error messaging on the Administration > Settings > Keystore page and in the logs.
• Fixed an intermittent display issue which could cause page styles to render incorrectly when navigating between specific screens in the administration console.
• Updates to translations.

January 8, 2020

• Fixes an issue in which downloading files from Forensic File Search was not available in the Safari web browser.
• Improves error messaging if File Size search criteria is blank.