Introduction to Incydr

Risk Exposure dashboard

The Risk Exposure dashboard gives you a visible representation of where and how your data is moving so that you can quickly grasp file events that need your attention. Use the risk indicators to further help you focus your initial investigations on more risky file activity. 

Insider Risk Trends dashboard

Alerts

Alerts give you visibility into when important data may be leaving your company. Alerts automatically notify you about file activity occurring along a number of exposure vectors. You can create multiple alert rules to alert you for different exposure types, severities, and users causing the file activity. 

All Users list

The All Users list shows all of the users in your Code42 environment sorted by the highest number of critical-severity file events, then by high-severity file events. On this list, you can see the risk indicators associated with a user's file events and see more details about their most recent file activity. For more information, see All Users reference.

Watchlists

Adding an employee to a watchlist allows you to more closely monitor their file events. Each watchlist can have its own set of alerts to notify you of any risky behavior. For more information, see Secure data throughout employee tenure.  

Cases

Cases allow you to compile, document, and share details about insider risks. This helps you assemble evidence to make more informed decisions about how to respond, and also provides a permanent record of the file activity and users associated with the investigation.

Recover and view file contents

Incydr can also recover files, including deleted files and previous file versions. During an investigation you can restore a single file, multiple files, or even an entire device, allowing you to inspect the contents of the files involved.

Additionally, you can download the file from Forensic Search while conducting an investigation into an event to immediately view its contents and better assess risk. 

Legal hold 

Adding a user to a legal hold backs up a separate copy of the user's files and retains them for as long as you specify. This enables you to preserve files separately from the user-facing backup and retain files indefinitely for additional investigation or future legal action.

Endpoint file event detection

The agent, running on either Windows, Mac or Linux endpoints, logs all file events (like file creation, deletion, and modification) and captures critical metadata including file name, owner, size, category and MD5 hash. The agent monitors:

• Files moved to removable media (such as flash drives, hard drives, and cards that connect via USB, eSata, or Thunderbolt), collecting the vendor, name, and serial number of the devices used.
• Files in cloud sync folders for Dropbox, iCloud, OneDrive, and Box.
• Files that have been read or uploaded by browsers such as Internet Explorer, Chrome, Firefox, Safari, Edge, Chromium, and Opera. For such activity, the agent logs the browser name, the tab title, and the URL used to upload the file.
• Files that have been read by web applications such as FileZilla, Windows Secure Copy, Slack, SFTP, FTP, cURL, and Secure Copy.

Cloud and email file event detection

Incydr integrates with corporate cloud services such as Box, Google Drive, and OneDrive to detect when files saved in corporate cloud drives are shared publicly or with external users by employees.

Likewise, Incydr integrates with corporate email services like Gmail and Office 365 to detect potential data exfiltration of file attachments sent to untrusted recipients.

Expected time ranges for events to appear

Metadata collected

Incydr collects the following categories of metadata for file events. For detailed descriptions of all metadata, see File event metadata reference.

• Risk: The event's overall risk severity and all associated risk indicators.
• Event: Summary information including date observed, event action, and sharing details.
• User: Details about the user associated with the event.
• File: Provides a link to download the file, along with details such as the file's name, path, owner, hash, and other metadata.
• Source: Provides details about the origin of the file.
• Destination: Provides details about the where the file was sent or moved.

The metadata applicable to each event varies based on the specifics of the file activity. For example, an event for a file moved to removable media has different details than an event for a file shared via a cloud service.

Response controls

Incydr leverages broad and deep visibility into ALL data activity and user behavior to better understand true risk. Incydr does not rely on classification of data to identify exfiltration events, but instead correlates data, vector, and user information to improve visibility and provide context.

For the times when you need to respond to insider risk, use Incydr to respond appropriately. For example, you can use identity and access management to put users in groups to restrict access based on the alerts and information Incydr provides. For more information about response options, see Introduction to Incydr Flows. 

For more information about how Incydr prevents data loss without blocking productivity, download our guide.