icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.

Accept License Agreements

Thank You

Downloading Code42 v3
SHA256 checksum (code42-v3_100.tgz) 10dbe1a0dc4d1cd0fe292bc1b717c5339b7ccfbfe5a821607f57b83dd5d676e5

Flag As Inappropriate

soar

Code42 v3

Splunk SOAR Cloud
Splunk Built
Overview
Code42 provides simple, fast detection and response to everyday data loss from insider threats by focusing on customer data on endpoints and the cloud

Supported Actions Version 1.0.0

  • test connectivity: Validate the asset configuration for connectivity using supplied configuration
  • on poll: Callback action for the on_poll ingest functionality
  • get session details: Get the details of a session
  • run query: Search for file events using EventQuery
  • search sessions: Search for sessions using optional filters
  • run advanced query: Execute an advanced file event query using a json filter definition
  • set session state: Update the state of one or more sessions
  • get actor by id: Retrieve details for a single actor by id
  • get actor by name: Retrieve details for a single actor by name
  • list users: List Code42 users with optional filters
  • deactivate user: Deactivate a Code42 user
  • reactivate user: Reactivate a Code42 user
  • get user: Retrieve details for a single user
  • create case: Create a new case
  • update case: Update details for an existing case
  • close case: Close an open case
  • add case event: Attach file events to a case
  • add legalhold custodian: Add a custodian to a legal hold matter
  • remove legalhold custodian: Remove a custodian from a legal hold matter
  • update actor: Update actor metadata and monitoring dates
  • list cases: List cases with optional filters
  • list available watchlists: List watchlists available to an actor
  • get watchlist id by name: Resolve a watchlist ID either by its type (ex: `DEPARTING_EMPLOYEE`) or its title in the case of `CUSTOM` watchlists
  • create watchlist: Create a new watchlist
  • delete watchlist: Delete a watchlist
  • add actors to watchlist: Add actors to a watchlist
  • remove actors from watchlist: Remove actors from a watchlist
  • list actors in watchlist: List actors currently in a watchlist
  • hunt file: Hunt for a file in the Incydr platform

Release Notes

Version 1.0.0
Nov. 5, 2025
  • initial release of incydr sdk based code42 connector

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk LLC in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.