> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/help/videos.md). # Videos Best practice videos that walk you briskly through DoControl features and use cases ## Setup Best practice videos for setting up DoControl to get started. ### DoControl login with generic SAML You can choose any identity provider that supports SAML 2.0 to log into DoControl. [Generic SAML](/docontrol-user-guide/system-management/settings/single-sign-on-sso/generic-saml.md) makes single sign-on (SSO) possible by authenticating a user once and then communicating that authentication to multiple applications. {% hint style="success" %} After you configure your generic SAML, for example [JumpCloud](/docontrol-user-guide/system-management/settings/single-sign-on-sso/jumpcloud-sso.md), you can use your JumpCloud credentials to login via DoControl. {% endhint %} {% embed url="" %} ### Add and delete users Learn how to add up to 100[ team members](/docontrol-user-guide/system-management/settings/settings-team.md) from your company domain. Each time a team member is added, you need to grant access in order to enable their account status. {% embed url="" %} ### Set up a Slack webhook in DoControl Learn how to set up a [webhook](/docontrol-user-guide/system-management/settings/connectors/settings-webhooks.md) to automatically send Slack notifications to users in your organization. Webhooks send notifications in real time, whenever a specific event happens as defined in a workflow. Having information in near real time is essential to addressing the security and compliance requirements of your organization. Integrating DoControl with Slack enables you to monitor file sharing within shared channels. You can configure DoControl to send notifications to specific channels or use the DoControl Slack bot to approve or deny sharing based on your organizational policy. {% embed url="" %} ### Asset management in DoControl Asset management continues to be a major challenge for enterprise security and IT teams, especially as organizations continue to adopt new SaaS applications. DoControl provides a consolidated view of [asset exposure](/docontrol-user-guide/saas-data-monitoring/inventory/inventory-assets.md) and user activity. For each integrated SaaS app, assets are displayed according to the native SaaS content structure. The Assets page gives you insight into the exposure for each asset, what is shared, and with whom. Learn how to filter assets and extract relevant data such as sharing status, and perform inventory actions per asset or in bulk. {% embed url="" %} ### Lexical lists in DoControl Learn how to leverage DoControl's out-of-the-box [keyword lists](/docontrol-user-guide/system-management/settings/lexical-lists.md) for scanning. These lists are customizable, and can be included or excluded when defining workflows. DoControl keyword lists include: * **Encryption key file** - A set of file extensions that indicate a file has been encrypted. * **Ransomware encryption file** - Common ransomware file extensions. * **Private email domains** - A set of private, non-corporate email domains. In workflows, these domains can be used to trigger alerts if assets are downloaded or shared with them. * **Sensitive keyword list** - A set of words indicating PII (personally identifiable information) or company proprietary information that can be leveraged in workflows. {% embed url="" %} ### Domains and trusted IPs DoControl displays your organization's shared assets across external, internal, and trusted [domains](/docontrol-user-guide/saas-data-monitoring/inventory/inventory-domains.md). You can define policies for each domain where assets are shared. By not sharing assets with untrusted domains, you limit your organization's external exposure and mitigate the external risk of multi-SaaS data and permission sprawl. Defining trusted [organization IPs](/docontrol-user-guide/saas-data-monitoring/inventory/trusted-ips.md) helps your organization to reduce risk and address potential threats. After you define your list of trusted domains and organization IPs, you can use them as [conditions](/docontrol-user-guide/saas-data-monitoring/inventory/trusted-ips.md#use-trusted-ips-in-workflow-conditions) in workflows. {% embed url="" %} ## Alerts Best practice videos for configuring and managing DoControl alerts. ### Using alerts in DoControl DoControl [alerts](/docontrol-user-guide/risk-management/alerts.md) are automatic notifications that provide insights into anomalous user behavior across all your integrated SaaS apps. Learn how you can: * Filter and get information on each alert (such as the actor, targets, and the asset involved) * Link directly to the assets involved and perform remediation actions * Create workflows to support use cases from triggered alerts * Configure alerts by assigning a risk index, focusing on significant alerts, and excluding safe targets. {% embed url="" %} ## Workflows Best practice videos for creating and leveraging DoControl workflows to automatically remediate any SaaS app data risks. ### Get started with workflows in DoControl Learn how to create automated workflows in DoControl with no-code conditional logic. [Workflows](/docontrol-user-guide/workflows/workflow-overview.md) enable consistent enforcement and risk remediation across all SaaS applications, many of which cannot be achieved natively in each individual application. ‍ Learn how to customize workflows using DoControl's visual drag-and-drop canvas, where you can define use cases with actions, triggers, remediation steps and paths. {% embed url="" %} ### Workflow anatomy and best practices Using a catalog of playbooks, you can customize DoControl's workflow automation to address your organizational security program requirements. DoControl provides several one-click inventory action [workflows](/docontrol-user-guide/workflows/define-workflow-settings/action-settings.md) that simplify common use cases that otherwise require a significant amount of manual labor to initiate. ‍ With a single click, learn how to remove all permissions to specific external collaborators, change data ownership, and turn certain data points from public to private. {% embed url="" %} ### Build a security workflow In this video learn how DoControl provides automated security no-code security workflows to extend zero trust beyond the identity, device and network into the SaaS data layer. Workflows are a flexible and visual way to monitor, control and remediate data access in your SaaS applications. You can create [workflows](/docontrol-user-guide/workflows/define-workflow-settings.md) to support a large variety of possible events, user actions, conditions and remediation actions, all based on a rich variety of playbook use cases, while supporting security policies in your organization. Workflows are flexible and granular enough to detect almost any malicious or anomalous behavior a user is doing, near real-time, in a specific application. {% embed url="" %} ### Workflow notifications With DoControl automated workflows, learn how to automatically [notify](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/notify.md) a user or group of users about an event via email, Slack or a webhook. For example, you can automatically notify an employee about an internal file that was shared with an external user. {% embed url="" %} ### Approval steps and looping functionality With DoControl automated workflows, learn how to send [approval](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/decide/approval.md) requests for a user’s action, such as sharing an asset publicly, via DoControl, email or Slack. The approval includes a customizable message to the approver, asking to either approve or reject the user's action. You then need to define subsequent actions for Approval, Rejection, and Timeout. You can also create a [loop](/docontrol-user-guide/workflows/define-workflow-settings/action-settings.md#loops) connection between the **Approval** action and any previous action in the workflow. {% embed url="" %} ### PII file scan SaaS data loss prevention is one of the biggest challenges organizations face today. Employees routinely share personally identifiable information (PII), such as bank account details, in SaaS apps. Learn how to set up workflows that perform automatic [PII file](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/query/pii-scan.md) scanning. DoControl uses natural-language processing (NLP) to provide near real-time scanning and classification for sensitive data types, such as PII, across all files stored in your SaaS applications. {% embed url="" %} ### Regex scan Learn how to configure a [regex scan](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/query.md#regex-scan) in a DoControl security workflow. A regex scan is a process of searching a string or document for patterns that match a particular regular expression. Regular expressions are commonly used in computer programming, text editors, and other applications to search, manipulate and validate text data. During a regex scan, the regular expression is applied to the text data, and the matching substrings are identified and extracted. This enables IT and security teams to flexibly extract data from text within a workflow, and prevent data loss within SaaS application environments. {% embed url="" %} ### Add API calls to workflows You can integrate with popular apps, such as Jira, Datadog, and VirusTotal using predefined [HTTP request actions](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/utilities.md#http-request) for specific use cases, such as: * Creating issues in Jira * Sending logs to Datadog * Checking for malicious files in VirusTotal using your own VirusTotal enterprise plan (recommended) or the public API {% embed url="" %} ## Use cases These videos demonstrate best practices for a range of SaaS application use cases. ### Insider risk with departing employee - part 1 Learn how to configure a workflow that will prevent data exfiltration by departing employees. When an employee resigns, the threat of insider risk becomes elevated as they often will send sensitive data to their private email accounts. In order to mitigate this risk, it's important to create [automated workflows](/docontrol-user-guide/workflows/define-workflow-settings.md), where high risk events trigger a workflow to block file sharing. {% embed url="" %} ### Insider risk with departing employee - part 2 Learn how to configure a workflow that will prevent data exfiltration by departing employees. When an employee resigns, the threat of insider risk becomes elevated as they often will attempt to download sensitive company data prior to their departure. In order to mitigate this risk, it's important to create [automated workflows](/docontrol-user-guide/workflows/define-workflow-settings.md), where high risk events trigger a workflow to identify sensitive file downloads, and automatically notify the relevant IT or security team. {% embed url="" %} ### Auto-expire public sharing in Google In this video, learn how to enforce the principle of least privilege at the SaaS application data layer in [Google Drive](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate/google-drive-remediation.md#remove-public-sharing). See how to create an automated access control policy that will enable public file sharing for 90 days, before automatically being revoked. This is a critical use case for ensuring that data overexposure is minimized. {% embed url="" %} ### Auto-expire external sharing in Google In this video, learn how to configure a workflow that will auto-expire external sharing in Google Drive. This demo video is a best practice to help minimize data overexposure, and mitigate the risk of data loss. {% embed url="" %} ### Notify on encryption key uploads in SharePoint In this video, learn how to create an automated notification for uploading [encryption keys](/docontrol-user-guide/system-management/settings/lexical-lists.md) in SharePoint. Encryption keys are privileged credentials that need to be protected. You can create workflows to notify the right people that they've been added to business-critical apps such as SharePoint, in order to mitigate the risk that these keys have been compromised. {% embed url="" %} ### Auto-expire public sharing in SharePoint In this video, learn how to enforce the principle of least privilege at the SaaS application data layer in SharePoint. We'll create an automated access control policy that will enable the public sharing of a file for 90 days, before automatically being revoked. This is a critical use case for minimizing data overexposure. {% embed url="" %} ### Auto-expire file shares with private email accounts Learn how to configure a workflow to automatically expire file shares with private email accounts. All too often, business users will share sensitive content with their private email accounts. After an employee resigns or is terminated, they should no longer have access to sensitive company data. In this example, we automatically revoke access to private email accounts after 30 days. {% embed url="" %} ### Auto-expire external file sharing in Box In this video, learn how to configure a workflow that will auto-expire [external shares in Box](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate/box-remediation.md#remove-shared-links). This demo video is a best practice to help minimize data overexposure, and mitigate the risk of data loss. {% embed url="" %} ### Auto-expire public file sharing in Box In this video, learn how to enforce the principle of least privilege at the SaaS application data layer in [Box](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate/box-remediation.md#remove-shared-links). We'll create an automated access control policy that will enable the public sharing of a file for 90 days, before automatically being revoked. This is a critical use case for ensuring data overexposure is minimized. {% embed url="" %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/help/videos.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.