Manage Rules reference


Alerts highlight risky file activity in your organization, such as when important data is moved to untrusted locations. This article describes the Manage Rules section of the Code42 console, where you view and update the rule criteria that trigger alert notifications.

For information about individual alerts generated based on these rules, see Review Alerts reference. For more details about rule criteria, see Create and manage alert rules.


Manage Rules

Use the Manage Rules screen to view, create, edit, duplicate, and delete existing alert rules that trigger alert notifications.

To add or edit alert rules:

  1. Sign in to the Code42 console.
  2. Select Alerts > Manage Rules.
    Manage Rules list
Item Description
a Risk settings

Click to open the risk settings where you can set the score of each risk indicator. Scores are used to calculate the severity of each file event. For more information, see the Risk settings reference.

To edit risk settings, you must have the Insider Risk Admin or Insider Risk Analyst role. Users with the Insider Risk Read Only role can view risk settings, but not make changes.

b Create rule Creates a new rule that you can use to alert you when important data may be leaving your company.
c Recommended rules

Creates a new rule from a pre-configured template that has recommended settings. Click one of the rule names to start creating a rule from that template, or click View all recommendations to view all of the recommended rules. You can change and customize the settings to match your specific needs.

d Rule name Name entered for the rule when it was created.
e Created Date the rule was created.
f Column sort column sort arrow icon Hover over any column header to see the sort option. Click the up arrow to sort results by this column in ascending order. Click the down arrow to sort in descending order.
g Last modified Date the rule was last changed. 
h Enable

Click to enable or disable rules.

  • Enable: Allows the rule to notify of you of potential file exfiltration based on its settings. 
  • Disable: Stops the alert from firing for all users that were added to the rule. The alert will no longer generate new notifications on the Review Alerts tab.
i Actions Options menu icon Click to make a copy of an existing rule or to delete a rule.
j View View details icon Click to view an alert rule's settings. For more information on editing rule settings, see Create and manage alert rules.
k Rows per page Select the number of rules to display on each page.
l Pagination Click the right and left arrows to scroll through pages of rules.

Recommended rule templates

Code42 includes a number of pre-configured, recommended rule templates. You can quickly create rules from these templates, modifying the default settings to match your needs and environment.

Recommended rules templates

To start creating a rule from a template:

  • If the template you want appears in the Recommended rules list, click its name.
  • Otherwise, click View all recommendations to view all recommended rule templates and then click the rule name. 

When the Step 1 of 3 panel opens for that template, use it to customize the rule for your unique needs and environment. Each recommended rule template uses alert rule settings to identify the specific file activity to alert on.

Alert rule settings

To create an alert rule, you select rule settings that match the activity you want to be alerted about. You can mix and match settings as needed to target specific activity your organization has identified as carrying the most risk.

Alert rule settings

For more information about a setting, follow these links:

After adding settings to a rule, complete the rule by naming it, giving it a description, and identifying the users you want to notify when Code42 detects activity matching the rule's criteria.

View rule

For any alert rule listed in the Manage Rules table, click View View details icon to view details about that rule. You can then change the rule name, description, and add or edit the rule's settings.

Rule details vary. Specific rules may display different details than those shown in the example below.

View rule settings

Item Description
a Rule name and description

The name and description entered when the rule was created. Rule names must be unique.

b Actions menu Options menu icon

Click OPtions menu icon to open the Actions menu to:

  • Edit the rule's name and description
  • Make a copy of the rule
  • Delete the rule
c Rule settings

The settings that were added to the rule when it was created. The options selected for each setting are also listed. Click the "more" link to view all of the options selected for that setting.

Code42 automatically monitors all destinations for activity. For this reason, Any destination is listed for Destination even when no Destination setting has been added to the rule. If you have selected specific destinations that filter the detection of matching activity, those destinations are listed instead.

"No users defined" error message
An error message appears when the rule has the Individual users setting but no users have been added to that setting.

You can either either add users to the Individual users setting or remove the setting entirely. If you remove the setting, you can instead add the Watchlists setting to the rule to monitor the activity of higher-risk users on a watchlist.
d Add setting Click to add a new setting to the rule and select its options.
e Edit Edit icon Click the edit icon to update the criteria for any item.
f Show default settings

Click to view additional settings and further define the criteria required to gerenate an alert.

For example, by default, Destination rules alert on all risk severities. If you want to limit alerts for a destination to only include critical events, click Show default settings and update the Risk severity criteria.

g View activity that matches this rule criteria

Click to view file events from the past 30 days that match these rule settings. Review the results to confirm that the rule identifies the activity you want to generate an alert.

  • If a very large number of results appear, consider further refining the criteria.
  • If few or no results appear, confirm the criteria is defined correctly.
h Actions

If you have an Code42 Instructor product plan or an Incydr product plan that includes Code42 Instructor, the lesson that is automatically sent via email or Slack to users when their risky activity triggers the alert rule. Click Edit Edit icon to update this lesson as needed.

To avoid lesson "fatigue," lessons are automatically sent to users only once every 30 days even if they repeat the risky activity within that timeframe.

i Notifications

The email addresses of the users who are automatically notified when activity that matches the rule is detected. Click Edit Edit icon to update these addresses as needed.

If you do not enter any email addresses, Code42 does not send any emails but still collects information about the file activity that triggers the alert. You can view these notifications in the Review Alerts table.

Alerts are only created for untrusted activity
Alerts only apply to events outside your list of trusted activity. Trusted file activity is still captured by Incydr and is visible in Forensic Search, but it does not generate alerts.