> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/alerts.md).

# Alerts

Alerts are automatic notifications that DoControl generates to provide insights into anomalous user behavior across all integrated SaaS apps. 

DoControl identifies inappropriate end-user behavior, such as external sharing of sensitive data, or file downloads by about-to-be terminated employees, and sends notifications to security teams via email or Slack. 

DoControl triggers two kinds of alerts:

* **DoControl alerts** - Alert types from DoControl's alert catalog cover a range of risky events in different SaaS apps
* **Agentic alerts** - Proactive AI-powered notifications for early threat detection\
  that analyze and contextualize, leverage benchmarks, and advise you what steps to take next

After being notified, your security team can open a direct link to the involved asset and either perform relevant remediation actions, or create workflows to support use cases for the alert type.

{% hint style="success" %}

* With the exception of aggregated alerts, all DoControl alerts are distributed in near real-time.
* **Google Drive** - If you are monitoring [one organizational unit or a few Google groups](https://docs.docontrol.io/docontrol-user-guide/risk-management/pages/A6mop4JbMDYZTtsX0XDO#id-4.-select-organizational-unit-optional), alerts are based on the monitored files belonging to the users or shared drives in the organizational unit.
  {% endhint %}

From the Alerts page you can:

* Get information on each alert (such as the actor, targets, and the asset involved)
* Learn about the risks and remediation options for each alert
* Filter alerts
* Manage alert lifecycle and assign users to alerts 
* Link directly to the assets involved and perform remediation actions 
* Create workflows to support use cases from the alerts

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FhpoT4XC5jrTHbUgQNOat%2Falert%20overview.png?alt=media&amp;token=f7c13802-bff0-475c-b67b-c9cdc26efaa4" alt=""><figcaption><p>The Alert page is enriched with alert metadata: mini-dashboard for active alerts, MITRE ATT&#x26;CK mapping, actor and target info</p></figcaption></figure>

## Alert mini-dashboard

The mini-dashboard gives you a birds-eye-view of all your active alert highlights. The mini-dashboard is live, clickable and updated according to user actions and whenever new alerts are triggered.

Whatever you click in the dashboard on top is displayed in the alert list below. This data visualization enables you to choose what data story to focus on from a constant source of truth.

{% hint style="warning" %}

* The Alert mini-dashboard summarizes alert data from **active** **alerts** (new and in progress alerts only).
* Suppressed or resolved alerts, as well as archived alerts, are **not** displayed in the mini-dashboard.
* Graphs in the mini-dashboard are displayed after **30 days**.
  {% endhint %}

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FAA8xCsHeVOmCA0krHwdc%2Falert%20mini-dashboard.png?alt=media&amp;token=4308abfa-f6b8-4ccb-baaf-9f5e32e3639f" alt=""><figcaption><p>The clickable alert mini-dashboard delivers a live summary of your alert data at a glance</p></figcaption></figure>

Summarized alert data available in the mini-dashboard includes:

* **Total number of active alerts** - With breakdown according to severity: high, medium and low. The active alerts displayed are either new or in progress.
* **Top risky departments** - Company departments that triggered the most alerts. Exact numbers are based on a critical mass of alerts.
* **Top risky actors** - The 5 users who triggered the most alerts, and number of alerts triggered.
* **MITRE ATT\&CK tactics** - MITRE tactics used by active alerts are highlighted (such as Persistence, Exfiltration), with links to MITRE ATT\&CK documentation.
* **Alert status** - Breakdown of alert statuses: New, in progress, suppressed, resolved and auto-resolved.
* **Top alert categories** - Most frequent event-based alert groupings, such as former employee, external sharing, and public sharing.

## Historic alerts

If your organization is new to DoControl, you can view historic alerts for Google Workspace events that occurred 6 months prior to your integration date.

The added value of historic alerts is that you can analyze events prior to integrating with DoControl.

{% hint style="info" %}

* Email or Slack notifications are not sent for historic alerts.
* Processing time to display historic alerts is about 1-3 days depending on your organization's size and traffic.
  {% endhint %}

**To view historic alerts:**

1. In DoControl, navigate to **Alerts**.

2. Scroll down to the **Alerts list**. Each alert is displayed with the date of the event that triggered it.<br>

   <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FSAVtSlyBr17Z25DI9CPf%2Fhistoric%20alerts.png?alt=media&amp;token=c1f304f3-ae63-447e-a387-c90a13f965ec" alt="" width="563"><figcaption></figcaption></figure></div>

3. Click the alert to open its details, including event data, and information related to the actor and target.

{% hint style="info" %}

* To configure alerts, see [Configure alerts](/docontrol-user-guide/risk-management/alerts/configure-alerts.md).
* Learn more about using alerts with [DoControl videos](/docontrol-user-guide/help/videos.md#how-to-use-alerts-in-docontrol).
* For information about specific alert types, go to **Help > DoControl Alert Specifications**.
  {% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/risk-management/alerts.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.