Overview
A healthy Incydr environment is one that actively collects file activity from endpoints and data connections and reports it in the Incydr console for review and investigation, including in dashboards, alerts, Forensic Search, and more. There are several tools available to help you identify devices that may need attention. This article describes how you can use these tools to identify and resolve issues to maintain and improve your environment health.
This article applies to the insider risk agent. For the backup agent, see Identify and resolve device issues in the Incydr console.
Environment monitoring tools
User data sources
The Data Sources tab on the user details screen shows the devices associated with a user along with the date and time those devices last reported any activity to the Incydr cloud. Use this information to identify specific devices that may not have reported any activity within a given timeframe or that may need to be upgraded.
Device details
Clicking a device listed in the Devices table or on the user details Data Sources tab opens the details for that device. Two fields on the device details screen can help you identify devices that may have issues:
- Agent version lists the version of the agent installed on the device to help you identify devices that may need to be upgraded.
- Last check-in shows the date and time the device last connected to the Incydr cloud. This can help you identify devices that haven't connected in some time and thus may not be reporting file activity or may need to be upgraded.
Data Connections status
Incydr API
Code42 CLI
Code42 CLI end-of-life
The Code42 CLI is now deprecated. It has been replaced by the Incydr CLI.
- The Code42 CLI will reach end-of-support on January 1, 2026, and end-of-life on January 1, 2027.
- To ensure uninterrupted functionality and access to the latest features, migrate your integrations to the Incydr CLI as soon as possible.
For more details, see our FAQ.
Code42 Insider Threat app for Splunk
Actions to improve environment health
Ensure devices are up-to-date
When a device is running an outdated version of the agent, it may not be reporting all file activity efficiently (or may not be reporting activity for new exfiltration vectors and destinations at all), which may represent a weakness in your insider risk management strategy. Use the tools in the Incydr console, API, or CLI to identify devices that aren't running the current version of the agent.
To troubleshoot device updates:
- Verify that those devices are still in use and can connect to the Incydr cloud. Deactivate devices that are no longer used to connect to Incydr.
- Verify that devices are using current deployment policy properties, scripts, and secrets. If the agent is deployed to a device with incorrect properties, initial installation may not have completed successfully (and thus, subsequent upgrades cannot complete either). Reactivate expired secrets or extend those that are about to expire as needed.
- If needed, uninstall and reinstall the agent to resolve issues with upgrading.
Troubleshoot connection issues
If a device is unable to connect, Incydr cannot accurately report security events or file activity occurring on that endpoint. Devices that are not connecting properly are also at risk of missing upgrades and may thus be running outdated versions of the agent.
Causes
The most common reasons that a device cannot connect to the Incydr cloud include:
- The user is on extended leave, and his or her endpoint is powered off or is not actively in use.
- The user has left the organization but has not been deactivated.
- The user has received a new device and no longer needs to use the previous endpoint.
- Other applications installed on the device are interfering with connectivity.
- Communication between the agent installed on the device and the Incydr cloud is blocked.
- An administrator is using deep packet inspection to examine traffic from devices to the Incydr cloud.
- Mac devices don't have full disk access, or the .mobileconfig file deployed to the device isn't set up correctly.
Solutions
To resolve device connectivity issues, take the following actions:
- Use the Incydr console, API, or CLI to verify that endpoints are connecting to the Incydr cloud and reporting file events as they should.
- Verify employee status with managers or your organization's Human Resources department.
- Deactivate users that are no longer with your organization.
- Deactivate devices that are no longer used to connect to Incydr.
- Verify that you have created exceptions for Incydr in any antivirus, security, or endpoint detection and response (EDR) applications your organization uses, and that those exception are valid and working correctly.
- Verify that the IP addresses and ports used by Incydr are open and that there is no deep packet inspection on traffic on port 4287. Verify that network traffic settings are optimized for where your employees work.
- Use Jamf's Privacy Preferences Policy Control (PPPC) Utility to create and deploy a .mobileconfig file to the Mac devices in your environment to grant these devices full disk access. When creating this file, verify that the settings are correct for your organization:
- In Properties, all areas you want to monitor are selected.
- In Apple Events, all web browsers you want to monitor for uploads are selected.
- In System Extensions, the agent team identifier and system extension are correct.
Comments
0 comments
Please sign in to leave a comment.