> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/alerts/configure-alerts/configure-agentic-alerts.md).

# Configure agentic alerts

Agentic alerts are proactive AI-powered notifications for early threat detection, where each alert type supports a use case in a specific SaaS app. 

These alerts analyze and contextualize, leverage benchmarks, and advise you what steps to take next, helping you to make smart decisions about complex situations in a more accurate way.

{% hint style="warning" %}

* Agentic alerts are a beta feature and are being released gradually.
* Agentic alerts are currently excluded from global alert metrics and calculations that appear in posture pages and dashboards.
  {% endhint %}

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FToeqq5u45Uv08WCCK623%2Fconfigure_agentic_alerts.png?alt=media&amp;token=7851a267-77fb-486d-b583-0d990a05b918" alt=""><figcaption></figcaption></figure>

You can customize these settings for each agentic alert type:

* [Configure alert severity](#configure-alert-severity) - Change the severity level (high, medium, low) for each alert type
* [Activate agentic alerts](#activate-agentic-alerts) - Receive only those alert types that are relevant to your organization. By default, agentic alerts are activated.
* [Notify on agentic alerts](#get-notifications-for-agentic-alerts) - Get notifications for only those alert types that are turned on. By default, alert notifications are disabled.
* [Customize agentic alerts](#customize-agentic-alerts) - Customize each agentic alert type separately, especially excluded actors, targets and connected Google apps

{% hint style="success" %}

* Before activating agentic alerts, make sure you configure general alert notifications, sensitive keywords, and auto-archive rules in [global settings](/docontrol-user-guide/risk-management/alerts/configure-alerts/configure-global-settings.md).
* For more information on alert parameters, see DoControl's Alert Specifications.
  {% endhint %}

## Configure alert severity

You can customize the level of severity for each agentic alert type to indicate how risky the alerted event is in your organization.

Assigning a severity level to each agentic alert type allows you to:

* Prioritize responses and manage risk, ensuring that the most critical issues are addressed first
* Leverage the severity level in workflows, SIEM and SOAR displays

**To configure the severity for each agentic alert type:**

1. In the DoControl platform, go to the Alerts page.
2. Click **Configure alerts**.
3. Select **Agentic alerts**.
4. For a specific alert type, go to the **Severity** column.
5. Click **Edit** <img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2Fc6VTTWoE7BkhXBkjJTz1%2Fedit%20icon.png?alt=media&amp;token=f098a875-7003-4414-8717-d827269b7b20" alt="" data-size="line"> and select **Critical**, **High**, **Medium**, **Low** or **Info**. <br>

   <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FhvhRhmYLbwq9yaZ2O1ME%2Fseverity%20agentic.png?alt=media&amp;token=26e3f645-4db4-4669-ba2c-3287fd3c3845" alt="" width="245"><figcaption></figcaption></figure></div>

## Activate agentic alerts

You can activate or deactivate specific alert types, so you only receive alerts that are relevant to your organization.

{% hint style="warning" %}
By default, all agentic alerts are **activated**.
{% endhint %}

Alert settings apply to all alerts of an alert type, not to a single alert. Changes made to an alert type apply to all integrated apps.

**To deactivate an alert type:**

1. In the DoControl platform, go to the Alerts page.
2. Click **Configure alerts**.
3. Select **Agentic alerts**.
4. For the relevant alert type, toggle the **Activate** button to **Off**.

When you activate or deactivate an alert type, DoControl updates the number of alerts turned on:&#x20;

<div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FbsUSNwaSg0EM5quNkDdt%2Factive%20agentic%20alerts.png?alt=media&amp;token=6c6ac0e8-22ed-41e5-bcef-4e703a150ad9" alt=""><figcaption></figcaption></figure></div>

## Get notifications for agentic alerts

Before turning notifications on for specific agentic alert types, make sure you configure general alert notifications in [global settings](/docontrol-user-guide/risk-management/alerts/configure-alerts/configure-global-settings.md).

{% hint style="warning" %}
By default, notifications for all agentic alert types are **turned off**.&#x20;
{% endhint %}

**To get notifications for an alert type:**

1. In the DoControl platform, go to the Alerts page.
2. Click **Configure alerts**.
3. Select **Agentic alerts**.
4. For the relevant alert type, toggle the **Notify** button to **On**.

When you turn on notifications for an alert type, DoControl displays the number of enabled alert notifications:&#x20;

<div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FG9QrqCz9yT4EUsoTpMEt%2Fagentic%20alerts%20with%20notifications.png?alt=media&amp;token=17fc916b-e377-4baf-9974-824326eb6bd6" alt=""><figcaption></figcaption></figure></div>

## Customize agentic alerts

In addition to [global exclusions for agentic alerts](/docontrol-user-guide/risk-management/alerts/configure-alerts/configure-global-settings/agentic-alert-exclusions.md), you can customize each agentic alert separately. The ability to customize each alert type gives you precise control over the number and scope of  triggered alerts.

**To customize an agentic alert type:**

1. In the DoControl platform, go to the Alerts page.
2. Click **Configure alerts**.
3. Select **Agentic alerts**.
4. For the relevant agentic alert type, click the **Customize** <img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FWkfN1O2BKZBlrnVXQ5Wu%2Fsettings%20icon.png?alt=media&amp;token=9336f06e-7a3c-4651-97c7-a1ccd2cbface" alt="" data-size="line"> icon.<br>

   <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FVQC9cSpwnrU7Z1x2RKDp%2Fcustomize%20agentic%20alert.png?alt=media&amp;token=7e36e6d2-b498-434c-9adc-ae2ce5953625" alt="" width="563"><figcaption></figcaption></figure></div>
5. To deactivate the agentic alert type, toggle the **Activate** button to **Off**.
6. To send **notifications** for the agentic alert type, toggle the **Notify** button to **On**.
7. To change the **alert severity** for the agentic alert type, click the **Edit** ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F25lV4ove5X8jg9huISiO%2FEdit%20icon%202.png?alt=media\&token=6e9ca545-9678-4764-979a-997823fa8c72) icon and select a severity level:
   * Critical
   * High
   * Medium
   * Low
   * Info
8. To **exclude actors** from triggering a specific agentic alert type, click the **Edit** ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F25lV4ove5X8jg9huISiO%2FEdit%20icon%202.png?alt=media\&token=6e9ca545-9678-4764-979a-997823fa8c72) icon and enter the actor emails.&#x20;
   * Actions performed by these users won't trigger this agentic alert type.
   * Any actors that are **globally** excluded from agentic alerts still apply to this alert.<br>

     <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FIy9hFzMRUnuKEbzTfpDG%2Fexclude%20agentic%20actors.png?alt=media&amp;token=92072eeb-3cee-4386-8e40-16be5a936269" alt=""><figcaption></figcaption></figure>
9. To **exclude targets** from triggering a specific agentic alert type, click the **Edit** ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F25lV4ove5X8jg9huISiO%2FEdit%20icon%202.png?alt=media\&token=6e9ca545-9678-4764-979a-997823fa8c72) icon and enter the target emails.&#x20;
   * Actions performed on these users won't trigger this agentic alert type.
   * Any targets that are **globally** excluded from agentic alerts still apply to this alert.<br>

     <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FgasJNzmvxLfq5TkbePs3%2Fexclude%20agentic%20targets.png?alt=media&amp;token=e3b1e342-210a-4c3e-a6aa-88bb4422f6b5" alt=""><figcaption></figcaption></figure>

## Filter agentic alerts

You can filter agentic alerts to configure according to these parameters:

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FIe7BVbpAZro8irZdkibG%2Ffilter%20agentic%20alerts.png?alt=media&amp;token=0889134e-ea37-44a6-94f0-c43de3925914" alt=""><figcaption></figcaption></figure>

<table><thead><tr><th width="184.90234375">Agentic alert filter</th><th>Description</th></tr></thead><tbody><tr><td>Alert name</td><td><p>Select an operator to search for a specific agentic alert name:</p><ul><li>Equals/ doesn't equal</li><li>Starts with/ ends with</li><li>Contains/ doesn't contain</li><li>Includes/ excludes</li></ul></td></tr><tr><td>Severity</td><td><p>Filter agentic alerts for one or more levels of severity:</p><ul><li>Critical</li><li>High</li><li>Medium</li><li>Low </li><li>Info</li></ul></td></tr><tr><td>Supported app</td><td><p>Filter agentic alerts for one or more supported applications:</p><ul><li>Entra ID</li><li>Google Drive</li><li>Google Workspace</li><li>Okta</li><li>Salesforce</li></ul></td></tr><tr><td>Category</td><td><p>Filter for groupings of agentic alerts:</p><ul><li>Admin configuration</li><li>External sharing</li><li>Identity and access</li><li>Insider risk</li></ul></td></tr><tr><td>Activation</td><td><p>Filter agentic alerts by their activation status:</p><ul><li>Activated - Alerts that are turned on</li><li>Deactivated - Alerts that are turned off</li></ul></td></tr><tr><td>App status</td><td><p>Filter agentic alerts by integration status:</p><ul><li>Integrated apps - SaaS apps that are integrated with DoControl</li><li>Not integrated apps - SaaS apps that are not integrated with DoControl</li></ul></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/risk-management/alerts/configure-alerts/configure-agentic-alerts.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.