--- title: Code42 Incydr slug: connectors/code42-incydr docTags: createdAt: 2026-06-09T16:29:36.950Z --- Code42 Incydr is a data risk detection and response platform that helps organizations protect against insider threats. Code42 INCYDR is a comprehensive insider threat detection and response platform. It enables organizations to efficiently manage and mitigate risks associated with data exfiltration and insider threats. By integrating Code42 INCYDR with Swimlane Turbine, users can automate the management of cases and sessions, streamline incident response, and enhance threat visibility. This integration empowers security teams to efficiently track incidents, update case details, and retrieve session information, thereby improving response times and reducing manual effort. ## Prerequisites Before you can use the Code42 Incydr connector for Turbine, you'll need access to the Code42 Incydr API. This requires the following: - OAuth2 authorization using the following parameters: - URL: The endpoint URL for accessing the Code42 Incydr API. - Client ID: The unique identifier for your application to authenticate with Code42 Incydr. - Client Secret: The secret key associated with your client ID for secure authentication. ## Capabilities The Code42 INCYDR Connector has the following capabilities: - Add Event to a case - Add Note to a Session - Create a Case - Delete a Case - Get All Cases for Tenant - Get Details of a session - Search for Sessions - Update a Case ## Notes - For more information on Code42 INCYDR is found at: [Code42 INCYDR API Documentation](https://developer.code42.com/api/) ## Additional Documentation - [Code42 Incydr Connector Documentation](https://docs.swimlane.com/connectors/code42-incydr) - [Code42 Incydr API Documentation](https://developer.code42.com/api/) # Configurations ## Code42 Incydr Oauth 2.0 Client Credentials Authenticates using oauth 2.0 client credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | client\_id | The client ID. | string | Required | | client\_secret | The client secret. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Add Event to a case Associate a specific event with a case in Code42 Incydr using the unique eventId and caseNumber. ### Endpoint - **URL:** `/v1/cases/{{caseNumber}}/fileevent/{{eventId}}` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | --------------------------------------- | | `path_parameters.caseNumber` | number | Required | Unique numeric identifier for the case. | | `path_parameters.eventId` | string | Required | The unique identifier for the event. | ### Input Example `{"path_parameters":{"caseNumber":349535,"eventId":"abcd24s"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `message` | string | Response message | ### Output Example `{"status_code":204,"response_headers":{"Date":"Wed, 07 Aug 2024 11:21:28 GMT","Server":"Apache/2.4.41 (Ubuntu)","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff","Expires":"Thu, 19 Nov 1981 08:52:00 GMT","Cache-Control":"no-store, no-cache, must-revalidate","Pragma":"no-cache","Content-Encoding":"gzip","Content-Length":"1468","Connection":"close","Content-Type":"text/html;charset=UTF-8"},"reason":"OK","json_body":{"message":"Event added to the case."}}` ## Add Note to a Session Add a custom note to a session in Code42 INCYDR using the provided session ID and note content. ### Endpoint - **URL:** `/v1/sessions/{{id}}/add-note` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------------------------------------------- | | `path_parameters.id` | string | Required | The ID of the session to add a note to. | | `noteContent` | string | Optional | The content of the note to add. Maximum supported character length is 2000. | ### Input Example `{"json_body":{"noteContent":"This is a new updated note for tracking."},"path_parameters":{"id":"2024112128"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `message` | string | Response message | ### Output Example `{"status_code":204,"response_headers":{"Date":"Wed, 07 Aug 2024 11:21:28 GMT","Server":"Apache/2.4.41 (Ubuntu)","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff","Expires":"Thu, 19 Nov 1981 08:52:00 GMT","Cache-Control":"no-store, no-cache, must-revalidate","Pragma":"no-cache","Content-Encoding":"gzip","Content-Length":"1468","Connection":"close","Content-Type":"text/html;charset=UTF-8"},"reason":"OK","json_body":{"message":"The note was added successfully."}}` ## Create a Case Initiate a new case in Code42 INCYDR using a specified name to streamline incident tracking and response. ### Endpoint - **URL:** `/v1/cases` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------------------------- | | `assignee` | string | Optional | The user UID of the administrator assigned to investigate the case. | | `description` | string | Optional | Brief description providing context for a case. | | `findings` | string | Optional | Markdown formatted text summarizing the findings for a case. | | `name` | string | Optional | The unique name given to the case. | | `subject` | string | Optional | The actor ID of the subject being investigated in this case. | ### Input Example `{"json_body":{"assignee":"273411254592236331","description":"Sample description","findings":"Sample findings","name":"Sample case name","subject":"421380797518239242"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 07 Aug 2024 11:21:28 GMT","Server":"Apache/2.4.41 (Ubuntu)","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff","Expires":"Thu, 19 Nov 1981 08:52:00 GMT","Cache-Control":"no-store, no-cache, must-revalidate","Pragma":"no-cache","Content-Encoding":"gzip","Content-Length":"1468","Connection":"close","Content-Type":"text/html;charset=UTF-8"},"reason":"OK","json_body":{}}` ## Delete a Case Permanently delete an existing case in Code42 INCYDR using the specified case number. ### Endpoint - **URL:** `/v1/cases/{{caseNumber}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | --------------------------------------- | | `path_parameters.caseNumber` | number | Required | Unique numeric identifier for the case. | ### Input Example `{"path_parameters":{"caseNumber":349535}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `message` | string | Response message | | `success` | boolean | Whether the operation was successful | ### Output Example `{"status_code":204,"response_headers":{"Date":"Wed, 07 Aug 2024 11:21:28 GMT","Server":"Apache/2.4.41 (Ubuntu)","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff","Expires":"Thu, 19 Nov 1981 08:52:00 GMT","Cache-Control":"no-store, no-cache, must-revalidate","Pragma":"no-cache","Content-Encoding":"gzip","Content-Length":"1468","Connection":"close","Content-Type":"text/html;charset=UTF-8"},"reason":"OK","json_body":{"message":"Case Deleted.","success":true}}` ## Get All Cases for Tenant Retrieve all case details for a tenant in Code42 INCYDR, including status and assignee information. ### Endpoint - **URL:** `/v1/cases` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.status` | array | Optional | One or more case statuses on which to filter. | | `parameters.assignee` | string | Optional | User UID of an assignee of a case on which to filter. | | `parameters.isAssigned` | boolean | Optional | Filter cases with an assignee (true) or without (false). | | `parameters.name` | string | Optional | Name of a case on which to filter; will include partial matches | | `parameters.subject` | string | Optional | User UID of a subject of a case on which to filter. | | `parameters.lastModifiedBy` | string | Optional | User UID of the user who most recently modified the case. | | `parameters.createdAt` | string | Optional | Filter cases created between the supplied start and end times. Must use ISO time interval, for example - 2020-08-31T11:00:00Z/2020-09-01T15:30:00Z. | | `parameters.updatedAt` | string | Optional | Filter cases last updated between the supplied start and end times. Must use ISO time interval, for example - 2020-08-31T11:00:00Z/2020-09-01T15:30:00Z. | | `parameters.pgSize` | number | Optional | Max number of results to return for a page. | | `parameters.pgNum` | number | Optional | Page number for results, starting at 1. | | `parameters.srtKey` | array | Optional | One or more values on which the response will be sorted. | | `parameters.srtDir` | array | Optional | The direction on which to sort the response, based on the corresponding key. | ### Input Example `{"parameters":{"status":["OPEN"],"assignee":"","isAssigned":true,"name":"","subject":"","lastModifiedBy":"","createdAt":"2020-08-31T11:00:00Z/2020-09-01T15:30:00Z","updatedAt":"2020-08-31T11:00:00Z/2020-09-01T15:30:00Z","pgSize":2147483647,"pgNum":1,"srtKey":["number"],"srtDir":["asc"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `cases` | array | Output field: cases | | `totalCount` | number | Count value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 07 Aug 2024 11:21:28 GMT","Server":"Apache/2.4.41 (Ubuntu)","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff","Expires":"Thu, 19 Nov 1981 08:52:00 GMT","Cache-Control":"no-store, no-cache, must-revalidate","Pragma":"no-cache","Content-Encoding":"gzip","Content-Length":"1468","Connection":"close","Content-Type":"text/html;charset=UTF-8"},"reason":"OK","json_body":{"cases":[{}],"totalCount":74}}` ## Get Details of a session Retrieve detailed information for a specific session in Code42 Incydr, including alerts, using the session's unique ID. ### Endpoint - **URL:** `/v1/sessions/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | The session ID. | ### Input Example `{"path_parameters":{"id":"2024112128"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------- | -------- | ----------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `actorId` | string | Unique identifier | | `beginTime` | number | Time value | | `contentInspectionResults` | object | Response content | | `contentInspectionResults.eventResults` | array | Response content | | `contentInspectionResults.eventResults.eventId` | string | Unique identifier | | `contentInspectionResults.eventResults.piiType` | array | Type of the resource | | `contentInspectionResults.eventResults.status` | string | Status value | | `contentInspectionResults.status` | string | Status value | | `contextSummary` | string | Output field: contextSummary | | `criticalEvents` | number | Output field: criticalEvents | | `endTime` | number | Time value | | `exfiltrationSummary` | string | Output field: exfiltrationSummary | | `firstObserved` | number | Output field: firstObserved | | `highEvents` | number | Output field: highEvents | | `lastUpdated` | number | Output field: lastUpdated | | `lowEvents` | number | Output field: lowEvents | | `moderateEvents` | number | Output field: moderateEvents | | `noRiskEvents` | number | Output field: noRiskEvents | | `notes` | array | Output field: notes | | `notes.content` | string | Response content | | `notes.id` | string | Unique identifier | | `notes.sourceTimestamp` | number | Output field: notes.sourceTimestamp | | `notes.userId` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 07 Aug 2024 11:21:28 GMT","Server":"Apache/2.4.41 (Ubuntu)","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff","Expires":"Thu, 19 Nov 1981 08:52:00 GMT","Cache-Control":"no-store, no-cache, must-revalidate","Pragma":"no-cache","Content-Encoding":"gzip","Content-Length":"1468","Connection":"close","Content-Type":"text/html;charset=UTF-8"},"reason":"OK","json_body":{"actorId":"string","beginTime":0,"contentInspectionResults":{"even...` ## Search for Sessions Perform a comprehensive search for session-related information and alerts within Code42 Incydr. ### Endpoint - **URL:** `/v1/sessions` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------ | | `parameters.actor_id` | string | Optional | The ID of the actor to limit the search to. | | `parameters.on_or_after` | number | Optional | Only include sessions beginning on or after this instant. | | `parameters.before` | number | Optional | Only include sessions beginning before this instant. | | `parameters.has_alerts` | boolean | Optional | Only include sessions that have a matching alert status. Defaults to 'true'. | | `parameters.order_by` | string | Optional | Which way to order the results. If not provided, results are ordered by end time. | | `parameters.risk_indicators` | array | Optional | List of risk indicators that must be present on the sessions before they are returned. | | `parameters.sort_direction` | string | Optional | Which way to order the results. Either 'ASC' or 'DESC'. If not provided, results are sorted descending. | | `parameters.state` | array | Optional | Only include sessions that have a matching state. | | `parameters.severity` | array | Optional | Only include sessions that have a matching severity value. 0 indicates no risk, 1 = low, 2 = moderate, 3 = high, 4 = critical. | | `parameters.rule_id` | array | Optional | Optional list of rule ids to filter upon. | | `parameters.watchlist_id` | array | Optional | Optional list of watchlist ids to filter upon. | | `parameters.page_number` | number | Optional | The page number to return, starting with 0. If not provided, 0 is assumed. | | `parameters.page_size` | number | Optional | The number of results to return in a page. Max of '50'. | | `parameters.content_inspection_status` | string | Optional | The content inspection status to limit the search to. | ### Input Example `{"parameters":{"actor_id":"48924","on_or_after":10,"before":10,"has_alerts":true,"order_by":"end_time","risk_indicators":["process"],"sort_direction":"ASC","state":["OPEN"],"severity":[1,4],"rule_id":["101","104"],"watchlist_id":[""],"page_number":0,"page_size":10,"content_inspection_status":"PENDING"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------------- | -------- | ----------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.actorId` | string | Unique identifier | | `items.beginTime` | number | Time value | | `items.contentInspectionResults` | object | Response content | | `items.contentInspectionResults.eventResults` | array | Response content | | `items.contentInspectionResults.eventResults.eventId` | string | Unique identifier | | `items.contentInspectionResults.eventResults.piiType` | array | Type of the resource | | `items.contentInspectionResults.eventResults.status` | string | Status value | | `items.contentInspectionResults.status` | string | Status value | | `items.contextSummary` | string | Output field: items.contextSummary | | `items.criticalEvents` | number | Output field: items.criticalEvents | | `items.endTime` | number | Time value | | `items.exfiltrationSummary` | string | Output field: items.exfiltrationSummary | | `items.firstObserved` | number | Output field: items.firstObserved | | `items.highEvents` | number | Output field: items.highEvents | | `items.lastUpdated` | number | Output field: items.lastUpdated | | `items.lowEvents` | number | Output field: items.lowEvents | | `items.moderateEvents` | number | Output field: items.moderateEvents | | `items.noRiskEvents` | number | Output field: items.noRiskEvents | | `items.notes` | array | Output field: items.notes | | `items.notes.content` | string | Response content | | `items.notes.id` | string | Unique identifier | | `items.notes.sourceTimestamp` | number | Output field: items.notes.sourceTimestamp | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 07 Aug 2024 11:21:28 GMT","Server":"Apache/2.4.41 (Ubuntu)","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff","Expires":"Thu, 19 Nov 1981 08:52:00 GMT","Cache-Control":"no-store, no-cache, must-revalidate","Pragma":"no-cache","Content-Encoding":"gzip","Content-Length":"1468","Connection":"close","Content-Type":"text/html;charset=UTF-8"},"reason":"OK","json_body":{"items":[{}],"totalCount":0}}` ## Update a Case Update an existing case in Code42 INCYDR using a specified case number by modifying its name and status. ### Endpoint - **URL:** `/v1/cases/{{caseNumber}}` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `path_parameters.caseNumber` | number | Required | Unique numeric identifier for the case. | | `assignee` | string | Optional | The user UID of the administrator assigned to investigate the case. | | `description` | string | Optional | Brief description providing context for a case. | | `findings` | string | Optional | Markdown formatted text summarizing the findings for a case. | | `name` | string | Optional | The unique name given to the case. | | `status` | string | Optional | Indicates the status of the case. OPEN - The case is active and all aspects of the case are editable. CLOSED - The case is resolved. Closed cases cannot be re-opened or modified. Case data for closed cases is retained indefinitely. ARCHIVED - The case is no longer active. File events and file contents are permanently deleted and no longer accessible. Archived cases cannot be un-archived or modified. | | `subject` | string | Optional | The actor ID of the subject being investigated in this case. | ### Input Example `{"json_body":{"assignee":"273411254592236331","description":"Sample description","findings":"Sample findings","name":"Sample case name","status":"OPEN","subject":"421380797518239242"},"path_parameters":{"caseNumber":349535}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 07 Aug 2024 11:21:28 GMT","Server":"Apache/2.4.41 (Ubuntu)","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff","Expires":"Thu, 19 Nov 1981 08:52:00 GMT","Cache-Control":"no-store, no-cache, must-revalidate","Pragma":"no-cache","Content-Encoding":"gzip","Content-Length":"1468","Connection":"close","Content-Type":"text/html;charset=UTF-8"},"reason":"OK","json_body":{}}` # Response Headers | **Header** | **Description** | **Example** | | ---------------------- | ---------------------------------------------------------- | ----------------------------------- | | Cache-Control | Directives for caching mechanisms | no-store, no-cache, must-revalidate | | Connection | HTTP response header: Connection | close | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | Content-Length | The length of the response body in bytes | 1468 | | Content-Type | The media type of the resource | text/html;charset=UTF-8 | | Date | The date and time at which the message was originated | Wed, 07 Aug 2024 11:21:28 GMT | | Expires | The date/time after which the response is considered stale | Thu, 19 Nov 1981 08:52:00 GMT | | Pragma | HTTP response header: Pragma | no-cache | | Server | Information about the software used by the origin server | Apache/2.4.41 (Ubuntu) | | X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff | | X-Frame-Options | HTTP response header: X-Frame-Options | SAMEORIGIN |