Code42 (v6.1.18)
The Code42 INCYDR integration accelerates insider threat incident response and remediation procedures for potential data exfiltration across computers, email, cloud and SaaS apps.
- Author
- Code42
- Support
- partner
- URL
- https://support.code42.com/Administrator/Cloud/Monitoring_and_managing/Install_and_manage_the_Code42_app_for_Cortex_XSOAR
- Default data source
- Code42 Event Collector
- Categories
- Data Enrichment & Threat Intelligence
Incident fields (13)
- Code42 Alert ID
- Code42 Alert Risk Severity Summary
- Code42 Alert Type
- Code42 Alert URL
- Code42 File Events
- Code42 File Events Version
- Code42 SecurityAlert Description
- Code42 SecurityAlert Name
- Code42 SecurityAlert State
- Code42 SecurityAlert Timestamp
- Code42 Severity
- Code42 Username
- Exfiltrated Files
Integrations (2)
- Code42
- Code42 Event Collector
Layouts (1)
- Code42 Security Alert
Modeling rules (1)
- Code42 Code42 Modeling Rule
Playbooks (20)
- Add Employees to Departing Employee Watchlist
- Add Employees to New Hire Watchlist
- Check Incydr Status and Close XSOAR Incident
- Close Related XSOAR and Incydr Incidents
- Code42 Add Departing Employee From Ticketing System v2
- Code42 Copy File To Ticketing System v2
- Code42 Exfiltration Playbook
- Code42 File Download
- Code42 File Search
- Code42 File Search v2
- Code42 Security Alert
- Code42 Suspicious Activity Action v2
- Code42 Suspicious Activity Review v2
- Departing Employee Auto-Add
- Departing Employee Clean-Up
- Get Code42 Employee Information
- New Hire Auto-Add
- New Hire Clean-Up
- Remove Employees from Departing Employee Watchlist
- Remove Employees from New Hire Watchlist
Scripts (1)
- Code42FileEventsToMarkdownTable
README
Code42 integrates with Palo Alto Networks Cortex XSOAR to provide accelerated incident response and automated remediation to potential file exfiltration from insiders happening across endpoints, email, cloud and SaaS applications. The Code42 exfiltration playbook in Cortex XSOAR investigates potential file exfiltration and provides fast access to file events and metadata across physical and cloud environments.
Code42 together with Cortex XSOAR enables security teams to scale, standardize and accelerate their overall incident response process for Insider Risk, so they can quickly detect and respond to data risk when employees or temporary workers leave your organization.
- Identify potential data exfiltration and insider risk, while speeding investigation and response by providing fast access to file events and metadata across physical and cloud environments.
- Accelerate and standardize incident escalation workflows for insider threats throughout the employee lifecycle.
- Automate steps within the employee offboarding process by triggering a configurable lookback of an employee’s historic file movements for manager review.
- Right-size response to insider risk at scale, whether that be through automated action, alerting the employee’s manager for corrective conversation, or placing a user on legal hold.
- Remotely add employees to, or remove employees from, Code42 watchlists or to legal hold from within Cortex XSOAR.
- Leverage hundreds of Cortex XSOAR third-party product integrations to coordinate response across security functions based on insights from Code42.