> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/faqs/remediation.md). # Remediation FAQs on how to remediate data exposure With remediation actions, DoControl provides your organization with an automated way to detect and prevent unnecessary or risky exposure across your integrated SaaS apps. By responding immediately to emerging SaaS security threats such as unsanctioned application usage and overly permissive user settings, you can easily reduce historical and future SaaS data exposure. This helps to protect your organization from data breaches and sensitive data loss.
Q. What is DoControl remediation? A. DoControl remediation allows you to implement automated remediation actions through workflows to prevent future data exposure across various SaaS applications like Google Drive, Box, Slack, OneDrive, SharePoint, and more. These actions can automatically remove collaborators, delete files, remove public sharing links, and perform other security operations based on conditions you define. You can also manually trigger on-demand remediation actions in your SaaS app inventory to resolve specific issues when you discover them.
Q. What SaaS app files can be remediated by DoControl? A. DoControl supports automatic remediation actions for these SaaS apps: * Box * Dropbox * Microsoft Entra ID * Google Drive * Google Workspace * Jira * OneDrive * SharePoint * Slack * Slack Enterprise * Zoom Each application has specific remediation actions available, such as removing collaborators, deleting files, and changing sharing permissions.
Q. Can I automatically remove collaborators from files containing sensitive information? A. Yes, you can set up workflows to automatically remove collaborators from files containing sensitive information. For sharing in Google Drive, you can customize one of DoControl's pre-defined playbooks: * [Remediate external sharing of sensitive content](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/external-collaborator-sharing/google-drive-playbooks-for-external-sharing#remediate-external-sharing-of-sensitive-content) * [Remediate external sharing of sensitive Regex content](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/external-collaborator-sharing/google-drive-playbooks-for-external-sharing#remediate-external-sharing-of-sensitive-regex-content) * [Remediate external sharing of PII](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/external-collaborator-sharing/google-drive-playbooks-for-external-sharing#remediate-external-sharing-of-pii) DoControl supports automatic collaborator removal for these SaaS apps: Google Drive, Box, OneDrive, and SharePoint.
Q. Can I remediate archived Google users? A. Yes, DoControl now remediates assets of archived users (Google users who were terminated).
Q. Can I restore collaborators who were automatically removed? A. Yes, you can restore collaborators using the **Add collaborator** remediation action. This is particularly useful in zero-trust workflows where you first remove external collaborators, then add an approval step, and restore them only after approval is granted.
Q. What happens when I change ownership of a Google Drive file? A. When you use the **Change asset owner** action for Google My Drive files, the ownership is transferred to the new owner you specify. This remediation action is useful when an employee leaves the company or is terminated—you can automatically transfer all their Google Drive assets to someone else through a workflow.
Q. How do I prevent malware propagation in Google Drive? A. If you use CrowdStrike Falcon, you can create a workflow that prevents malware from spreading through Google Drive. The workflow: 1. Is triggered when CrowdStrike detects malicious files on endpoints 2. Uses a query action to retrieve all files with the hash value from the event 3. Deletes all potentially malicious files via their document IDs.
Q. Can I move files between Google Shared Drives? A. Yes, you can use the **Move file** action to move files from one shared drive to another, or to the integration admin's My Drive. This is useful for data retention policies, organizational changes, compliance needs, or operational requirements. Note that only files (not folders) can be moved, and the integration admin must have direct access to both origin and destination folders.
Q. How do I apply Google labels to files automatically? To apply Google labels automatically to Google files: 1. Create a workflow with a Google Drive trigger. 2. Add a Data scan action to check for specific classifiers. 3. Add a Conditional step to verify matches were found. 4. Use the **Add Google label** action and select up to 5 existing labels.\ The Google labels must already exist and be open to the entire organization, not restricted to specific groups.
Q. Can I remove OAuth apps from Microsoft Entra ID? A. Yes, you can implement a remediation action to delete OAuth apps from Microsoft Entra ID. This helps mitigate risk from unauthorized or excessive-permission apps. 1. Create a workflow with an **Add application** trigger. 2. Add conditions (such as checking if the app is from microsoft.com or Office365). 3. Optionally add an approval step. 4. Use the **Remove OAuth app** action with the app ID.
Q. How long does it take for remediation actions to take effect? A. DoControl remediates in near-real time. For example, DoControl deletes Slack files, Jira issues, and Zoom recordings in near-real time. OAuth apps are also deleted in near-real time. However, the exact timing may depend on the specific application and action being performed.
Q. What's the best practice for handling sensitive data in Slack Enterprise? A. For sensitive data in Slack Enterprise, best practices include: * Use the **Quarantine file** action before **Delete file** to allow for review. * Implement PII scanning to detect credit card numbers, SSNs, etc. * Create approval workflows so the security team can review flagged content. * Use the **Quarantine message** action to mask sensitive messages while they're under review. Only permanently delete after confirmation. Remember that deleted messages and files cannot be recovered.
{% hint style="success" %} To learn more, see [Remediate](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate.md). {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/faqs/remediation.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.