The Coro workspace

A Coro workspace is a virtual environment that encapsulates all relevant information related to a customer's organization for an administrator or security operative. Each administrator can access the Coro console to their own workspace to connect to cloud applications, add protected users, and define settings and policies for their suscribed protection modules.

Cloud applications

Workspaces are tied to specific domains in connected cloud applications and services. When you connect Coro to a cloud application, you specify a domain or administrative business account on that application.

This enables Coro to connect to the application and identify protectable user accounts which are then managable within your workspace.

If you have multiple corporate domains and cloud users, connecting the cloud application in the Coro workspace through coro.net allows access via an admin account. Only users from this specific domain are considered protectable and can be safeguarded.

Devices and users

The Agent enables Coro to monitor user activity on endpoint devices in accordance with the security policies and device posture settings configured in your workspace.

Through the workspace console, Coro provides subscribers with a link to an Agent installer package uniquely tied to your workspace:

The installer filename is automatically generated for each workspace. Installing the Agent on your endpoint devices allows seamless integration with the designated workspace ensuring smooth information flow between the Agent and the Coro service.

To learn more about deploying and using the Coro Agent, see using the Coro endpoint agent.

To learn more about configuring endpoint device settings and protection, see endpoint security.

The Coro console

To learn more about using the Coro console, see understanding the display.

Workspace status

Coro workspaces transition through status levels, each defining specific operational capabilities and access levels within the Coro platform. These status levels are:

• New
• Trial
• Subscription
• Inactive
• Archived

Each status represents a different stage in the workspace's lifecycle, from initial creation to full operational capability, and impacts how cloud applications, endpoint devices, and users are managed and protected.

MSP admin users and Coro administrators view their workspace statuses from the Manage Workspaces portal.

New

Coro assigns the New status to a workspace upon creation. In this initial state, no cloud applications or endpoint devices are connected, and no protected users are added. After a workspace transitions to a different status, it cannot revert to new. New workspaces have access to the following modules:

• Cloud Security
• Endpoint Security
• Email Security
• Endpoint Detection and Response (EDR)

Trial

Coro transitions a new workspace to Trial status when an onboarding event occurs for the first time, such as connecting a cloud application, initialization of first device, or setting up an inbound gateway.

Coro extends a workspace trial when an initial device is activated before the expiration date, based on the workspace type.

For a channel workspace:

• Coro sets the workspace trial period to 30 days if no endpoint devices are activated.
• When an initial device is activated within a trial workspace prior to the expiration date, Coro extends the trial by 30 days .
• For example, if 10 days remain in the trial when an initial device is activated, Coro extends the trial to 40 days .
• If a protected or protectable user then activates additional devices within a trial workspace prior to the expiration date, Coro reverts the workspace to Inactive status 30 days after the initial device activation.

For a child or regular workspace:

• Coro sets the workspace trial period to 14 days if no endpoint devices are activated.
• When an initial device is activated within a trial workspace prior to the expiration date, Coro extends the trial by 14 days .
• For example, if 10 days remain in the trial when an initial device is activated, Coro extends the trial to 24 days .
• If a protected or protectable user then activates additional devices within a trial workspace prior to the expiration date, Coro reverts the workspace to Inactive status 14 days after the initial device activation.

When a channel or regular workspace enters a trial state, Coro:

• Monitors data and generates tickets for both protected and protectable users.
• Remediates issues automatically for protected users.
• Displays all tickets for protected and protectable users in the Actionboard.
• Generates tickets for all devices in both Visibility mode and regular mode for protected and protectable users.

Subscription

Coro classifies a workspace as a subscription based on the workspace type.

For root channel and regular workspaces:

• Coro classifies a workspace as a subscription when a Coro admin user with sufficient permissions selects Start Subscription from the actions menu of the workspace within the Manage Workspaces .

For descendant channel and child workspaces:

• Coro classifies a workspace as a subscription when an MSP admin user selects Start Subscription from the actions menu of the workspace within the Manage Workspaces .

When a workspace is in a subscription state Coro provides the following functionality based on the workspace type.

For a channel workspace, Coro:

• Monitors data and generates tickets in both Visibility mode and regular mode for protectable users based on the Scan unprotected users option selected when creating the workspace.

  note

  When Scan unprotected users is enabled, Coro monitors data but does not automatically remediate tickets for protectable users.

• Displays all tickets for protected and protectable users in the Actionboard.

For a regular workspace, Coro:

• Monitors data and generates tickets in both Visibility mode for protected users.
• Stops monitoring data and generating tickets for protectable users.
• Displays all tickets for protected users in the Actionboard.

For more information on channel workspace hierarchy, see Channel hierarchy.

Inactive

Coro classifies a workspace as inactive if it is in Trial or Subscription status and the trial or subscription expires. Additionally, if a trial ends without an active subscription following it, Coro automatically changes the workspace's status to Inactive.

When a workspace is in an inactive state, Coro:

• Stops monitoring data and generating tickets.
• Retains module-independent assets such as users, cloud applications, and devices associated with the workspace. This ensures efficient onboarding if the workspace subscription is renewed.
• Discards module-dependent assets, such as the infrastructure required to keep specific module features functioning.

Archived

MSP admin users can archive child workspaces belonging to their MSP that are in New or Inactive status.

Coro administrators can archive channel, child, and regular workspaces that are in New or Inactive status.

When a workspace is archived, any cloud applications are disconnected and network settings are cleared. You can’t sign into archived workspaces. For more information, see Archive a workspace.

Coro administrators can restore archived channel, child, and regular workspaces as inactive workspaces. For more information, see Restore a workspace.