Skip to content




Incydr is a SaaS data risk detection and response product that allows security teams to effectively mitigate data exposure and exfiltration risks without disrupting legitimate collaboration.

Product Details

Vendor URL: Code42

Product Type: SaaS data risk detection and response

Product Tier: Tier II

Integration Method: Custom

Integration URL: Code42 - Cyderes Documentation

Log Guide: Sample Logs by Log Type

Parser Details

Log Format: JSON

Expected Normalization Rate: near 100%

Data Label: CODE42_INCYDR

UDM Fields (list of all UDM fields leveraged in the Parser):

Log File Field UDM Field
actor principal.user.userid
actorId principal.user.product_object_id
"Code42" metadata.vendor_name
description security_result.description
"GENERIC_EVENT" metadata.event_type
id metadata.product_log_id
"Incydr" metadata.product_name
name security_result.summary
riskSeverity security_result.severity
ruleId security_result.rule_id
ruleSource security_result.rule_type
severity security_result.severity_details
state security_result.action_details
tenantId metadata.product_deployment_id
type metadata.description
type$ metadata.product_event_type

Product Event Types

Product Event Description UDM Event
All All events GENERIC_EVENT

Log Sample

{"actor":"","actorId":"1234","createdAt":"2021-12-20T23:54:46.6929430Z","description":"This default rule alerts you when high risk employees move data from an endpoint.","id":"ID_NUMBER","name":"Exposure on an endpoint","riskSeverity":"MODERATE","ruleId":"RULE-id","ruleSource":"High Risk Employee","severity":"MEDIUM","state":"OPEN","target":"N/A","tenantId":"Tenant_ID","type":"FED_COMPOSITE","type$":"ALERT_SUMMARY"}

Sample Parsing

metadata.product_log_id = "ID_NUMBER"
metadata.product_deployment_id = "Tenant_ID
metadata.description = "FED_COMPOSITE"
metadata.event_timestamp = "2021-12-20T23:54:46.6929430Z"
metadata.event_type = "GENERIC_EVENT"
metadata.vendor_name = "Code42"
metadata.product_name = "Incydr"
metadata.product_event_type = "ALERT_SUMMARY"
metadata.ingested_timestamp = "2021-12-20T23:54:46.6929430Z"
principal.user.user_id = ""
principal.user.product_object_id = "1234"
security_result.action_details = "OPEN"
security_result.description = "This default rule alerts you when high risk employees move data from an endpoint."
security_result.rule_id = "RULE-id"
security_result.rule_type = "High Risk Employee"
security_result.severity = "MODERATE"
security_result.severity_details = "MEDIUM"
security_result.summary = "Exposure on an endpoint"

Parser Alerting

This product currently does not have any Parser-based Alerting


Coming Soon