> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/faqs/alerts.md).

# Alerts

FAQs on DoControl's automatic notifications

DoControl automatically generates alerts to provide insights into anomalous user behavior across all your integrated SaaS apps.

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FGxQLt2eifjE1TE8jiyua%2Falert%20mini-dash.png?alt=media&amp;token=6a6fd092-be80-41f8-8f9c-5585d4cdea10" alt=""><figcaption></figcaption></figure>

<details>

<summary>Q. <strong>What are DoControl alerts and how do they work?</strong> </summary>

A. DoControl alerts are automatic notifications that identify anomalous user behavior across integrated SaaS apps, such as external sharing of sensitive data or file downloads by about-to-be terminated employees.&#x20;

Security teams receive these notifications via email or Slack and can then perform remediation actions or create workflows. With the exception of aggregated alerts, all DoControl alerts are distributed in near real-time.

</details>

<details>

<summary>Q. How often can I expect to get alerts? </summary>

A. Most DoControl alerts are distributed in near real-time, with the exception of aggregated alerts which are calculated based on multiple events occurring over a period of time. More complicated alerts might take longer to process (up to 24 hours).

</details>

<details>

<summary>Q. Something was shared with a private email. Why didn’t I get an alert for it?</summary>

A. DoControl doesn't generate alerts for every file shared with a private email address. What's distinctive about DoControl alerts is the severity and uniqueness of the events that trigger them. If you're looking for a broader or more frequent mode of notification, we recommend creating a workflow that targets such events and notifies accordingly.

</details>

<details>

<summary>Q. <strong>Can I view historic alerts from before I integrated with DoControl?</strong> </summary>

A. Yes, if your organization is new to DoControl, you can view historic alerts for Google Workspace events that occurred up to 6 months prior to your integration date. The processing time to display historic alerts is about 1-3 days depending on your organization's size and traffic. Note that email or Slack notifications are not sent for historic alerts.

</details>

<details>

<summary>Q. <strong>What does it mean when an alert shows "Processing data" status?</strong> </summary>

A. The "Processing data" status appears when:&#x20;

1. Assets are still being processed in DoControl's inventory, or
2. Assets were deleted after the alert was triggered—either by the actor, target, or by a remediation action in a workflow. This means the alert snapshot has changed and some assets might not be displayed.

</details>

<details>

<summary>Q. <strong>How can I filter alerts to focus on the most important ones?</strong> </summary>

A. You can filter alerts by:&#x20;

* Active vs. archived status
* Severity level (high, medium, low)
* Alert status (new, in progress, suppressed, resolved, auto-resolved)
* SaaS app
* Additional parameters including actor, alert category, alert ID, alert type, date, department, MITRE tactic, and target

</details>

<details>

<summary>Q. <strong>What are alert statuses and how should I use them?</strong> </summary>

A. Alert statuses include:&#x20;

* **New** (initial status of newly-generated alerts)
* **In progress** (incident being investigated)
* **Suppressed** (alert is irrelevant or carries no risk)
* **Resolved** (investigation completed)
* **Auto-resolved** (automatically resolved by DoControl without manual intervention).&#x20;

Changing statuses helps manage the alert lifecycle and minimize the number of new alerts.

</details>

<details>

<summary>Q. <strong>Can I assign alerts to specific team members?</strong> </summary>

A. Yes, you can assign alerts to DoControl team members one-by-one or in bulk. When an alert is assigned, the team member automatically receives a notification email with alert details and a direct link. Once assigned, the alert status automatically changes from **New** to **In progress**. You can also reassign alerts or remove team members from alerts.

</details>

<details>

<summary>Q. <strong>How do I configure which keywords trigger sensitivity alerts?</strong> </summary>

A. Go to **Settings > Alerts > General** and manage two lists:

* **Include keywords** (up to 1,000 keywords that trigger alerts when detected in file names)
* **Exclude keywords** (keywords that won't trigger alerts). If keywords from both lists are detected, an alert is still generated.&#x20;

These settings apply to alerts DC3, DC6, DC7, DC8, and DC105.

</details>

<details>

<summary>Q. <strong>Can I automatically archive old alerts?</strong> </summary>

A. Yes, you can configure auto-archiving of suppressed or resolved alerts after a defined interval (minutes, days, or months). By default, DoControl archives suppressed and resolved alerts after 30 days. This helps keep your alert inbox organized while maintaining archived alerts for future reference.

</details>

<details>

<summary>Q. <strong>What is the auto-resolve feature and which alerts support it?</strong> </summary>

A. Auto-resolve automatically resolves specific alert types without manual intervention. Currently, this feature is only supported for DC6 (Public sharing of sensitive files in Google Drive). The alert is auto-resolved when an actor removes the public sharing links of Google assets that triggered the alert. Auto-resolve is turned on by default for DC6.

</details>

<details>

<summary>Q. <strong>How do I prevent certain users or domains from triggering alerts?</strong> </summary>

A. Follow these steps to configure per alert type:

1. Navigate to **Settings > Alerts > Alert configuration**, and select the specific alert type.&#x20;
2. Configure either:&#x20;
   * **Exclude actors** (to prevent specific users, groups, or domains from triggering that alert type), or&#x20;
   * **Exclude targets** (to prevent alerts when sharing with specific users, groups, or domains).

</details>

<details>

<summary>Q. <strong>What is MITRE ATT&#x26;CK and how does DoControl use it?</strong> </summary>

A. MITRE ATT\&CK is a framework describing adversary actions to compromise enterprise networks. Each DoControl alert is mapped to specific MITRE ATT\&CK tactics (why an adversary performs an action) and techniques (how they achieve their goal).&#x20;

This helps classify cyberattacks, assess risk, and prioritize security issues. DoControl displays these mappings in the alerts page with clickable links to full MITRE ATT\&CK documentation.

</details>

<details>

<summary>Q. <strong>Can I create automated workflows to respond to specific alerts?</strong> Y</summary>

A. Yes, you can define alert-triggered workflows that run automatically when specific alert types are generated. These workflows can implement remediation actions like notifying teams, removing public sharing links, or changing asset owners.&#x20;

You can create workflows from predefined playbooks or from scratch, helping close the remediation loop faster and ensure better long-term risk coverage.

</details>

<details>

<summary>Q. <strong>How do I integrate alerts with Jira for ticket management?</strong> </summary>

A. You can open Jira tickets directly from DoControl alerts:

1. First-time setup requires entering your Jira company prefix and project ID.&#x20;
2. After setup, click **Open Jira ticket** to automatically populate a Jira story with alert details and a link to the full alert. This streamlines the remediation workflow without requiring formal DoControl-Jira integration.

</details>

<details>

<summary>Q. <strong>How do I remediate an alert once it's been triggered?</strong></summary>

A.  Click the **Remediate** button at the top-right of any alert to access two options:&#x20;

1. **Inventory actions** - Perform on-demand remediation actions on assets involved in the alert (like removing public sharing or deleting files), which opens a filtered asset page showing all affected assets, or&#x20;
2. **Workflows** - Create new automated workflows from playbooks or scratch to handle similar future use cases. This helps mitigate both short-term risks (immediate remediation) and long-term risks (automated prevention).

</details>

{% hint style="success" %}
For more information, see [Configure alerts](/docontrol-user-guide/risk-management/alerts/configure-alerts.md).
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/faqs/alerts.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.