Configure Trusted Activities
You can add trusted activities to your organization to prevent file activity associated with these locations from appearing in your security event dashboards, user profiles, and alerts.
Get CSV Template
The following command generates a CSV template to either create, update, or remove multiple trusted activities at once. The CSV file is saved to the current working directory.
code42 trusted-activities bulk generate-template [create|update|remove]
You can then fill out and use each of the CSV templates with their respective bulk commands.
code42 trusted-activities bulk [create|update|remove] bulk-command.csv
Add a New Trusted Activity
Use the create
command to add a new trusted domain or Slack workspace to your organization’s trusted activities.
code42 trusted-activities create DOMAIN mydomain.com --description "a new trusted activity"
To add multiple trusted activities at once, enter information about the trusted activity into the create
CSV file template.
For each activity, the type
and value
fields are required.
type
indicates the category of activity:
DOMAIN
indicates a trusted domainSLACK
indicates a trusted Slack workspace
value
indicates either the name of the domain or Slack workspace.
Then use the bulk create
command with the CSV file path. For example:
code42 trusted-activities bulk create create_trusted_activities.csv
Update a Trusted Activity
Use the update
command to update either the value or description of a single trusted activity. The resource_id
of the activity is required. The other fields are optional.
code42 trusted-activities update 123 --value my-updated-domain.com --description "an updated trusted activity"
To update multiple trusted activities at once, enter information about the trusted activity into the update
CSV file template, then use the bulk update
command with the CSV file path.
code42 trusted-activities bulk update update_trusted_activities.csv
Note
The bulk update
command cannot be used to clear the description of a trusted activity because you cannot indicate an empty string in a CSV format.
Pass an empty string to the description
option of the update
command to clear the description of a trusted activity.
For example: code42 trusted-activities update 123 --description ""
Remove a Trusted Activity
Use the remove
command to remove a single trusted activity. Only the resource_id
of an activity is required to remove it.
code42 trusted-activities remove 123
To remove multiple trusted activities at once, enter information about the trusted activity into the remove
CSV file template, then use the bulk remove
command with the CSV file path.
code42 trusted-activities bulk remove remove_trusted_activities.csv
Learn more about the Trusted Activities commands.