> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/alerts/configure-alerts/configure-docontrol-alerts.md).
# Configure DoControl alerts
DoControl's alert catalog includes several configurable alert types, where each one supports a specific use case across various SaaS apps.
{% hint style="success" %}
Before activating DoControl alerts, make sure you configure general alert notifications, sensitive keywords, and auto-archive rules in [global settings](/docontrol-user-guide/risk-management/alerts/configure-alerts/configure-global-settings.md).
{% endhint %}
You can customize these settings for each DoControl alert type:
* [Configure alert severity](#configure-alert-severity) - Change the severity level (high, medium, low) for each alert type
* [Activate alerts](#activate-alerts) - Receive only those alert types that are relevant to your organization
* [Auto-resolve ](#auto-resolve-alerts)- Automatically resolve specific alert types (currently only DC6 for public sharing in Google Drive)
* [Exclude actors](#exclude-actors) - Prevent specific actors from triggering alerts
* [Exclude targets](#exclude-targets) - Prevent specific targets from triggering alerts
All alert type details are visible in the DoControl alerts page
{% hint style="warning" %}
* You need **admin** permission to configure alerts.
* An example of a DoControl alert type is DC5 - Extensive public burst sharing
{% endhint %}
## Configure alert severity
You can customize the level of severity for each alert type to indicate how risky the alerted event is in your organization.
Assigning a severity level to each alert type allows you to:
* Prioritize responses and manage risk, ensuring that the most critical issues are addressed first
* Leverage the severity level in workflows, SIEM and SOAR displays
**To configure the severity for each alert type:**
1. In the DoControl platform, go to the Alerts page.
2. Click **Configure alerts**.
3. Select **DoControl alerts**.
4. For a specific alert type, go to the **Severity** column.
5. Select **High**, **Medium**, or **Low**.
## Activate alerts
You can activate or deactivate all alerts for a specific type.
For example, an organization might decide it doesn't want to be notified when employees share data with a personal email account. In that case, you can deactivate alert DC8: Shared sensitive file with personal email.
Alert settings apply to all alerts of an alert type, not to a single alert. Changes made to an alert type apply to all integrated apps.
{% hint style="warning" %}
* By default, all DoControl alerts are **activated**.
* We recommend exercising caution when deactivating alerts.
{% endhint %}
**To deactivate an alert type:**
1. In the DoControl platform, go to the Alerts page.
2. Click **Configure alerts**.
3. Select **DoControl alerts**.
4. For the relevant alert type, toggle the Activated button to **Off**.
When you deactivate an alert type, DoControl displays the number of alerts turned off.
## Auto-resolve alerts
When your inbox has too many alerts, it can take a lot of time and resources to resolve them manually. With auto-resolve alerts, DoControl automatically resolves specific alert types without manual intervention.
Alert DC6 (public sharing of sensitive files) now auto-resolves when an actor removes the public sharing links of Google assets that triggered the alert.
{% hint style="warning" %}
* Currently this feature is only supported for DC6: Public sharing of sensitive files in Google Drive.
* By default, auto-resolve is turned **on** for DC6.
{% endhint %}
The alert is indicated as auto-resolved and that’s one less alert to take care of
1. In the DoControl platform, go to the Alerts page.
2. Click **Configure alerts**.
3. Select **DoControl alerts**.
4. For a specific alert type, go to the **Auto-resolve** column.
5. Select the checkbox.
{% hint style="info" %}
To filter alerts that have been auto-resolved, see [Filter alerts by status](/docontrol-user-guide/risk-management/alerts/filter-alerts.md#filter-alerts-by-status).
{% endhint %}
## Exclude actors
You can define actors who will **not** trigger a specific alert type. An actor is a specific user, group or trusted domain.
1. In the DoControl platform, go to the Alerts page.
2. Click **Configure alerts**.
3. Select **DoControl alerts**.
4. For a specific alert type, go to the **Exclude actors** column.
5. Click **Configure**.
6. Select **equals** to define the target value for each specific user who won't trigger this alert type.
7. Select **contains** to enter an email domain such as **gmail.com** to exclude all gmail addresses from triggering alerts.
8. Select **in group** to enter a defined group from your HRIS or IdP or Google Drive apps. If these groups trigger the action, an alert will **not** be generated.
9. Select **in** **trusted domains** to exclude all [trusted domains](/docontrol-user-guide/saas-data-monitoring/inventory/inventory-domains.md#trusted-domains) from triggering alerts.
10. Click **Save**.
## Exclude targets
You can define targets who will **not** trigger a specific alert type. A target is a specific user, group or trusted domain. Actions involving these users, groups or domains as targets will not trigger this alert.
1. In the DoControl platform, go to the Alerts page.
2. Click **Configure alerts** .
3. Select **DoControl alerts**.
4. For a specific alert type, go to the **Exclude targets** column.
5. Click **Configure**.
6. Select **equals** to define the target value for each specific user who is the recipient of shared assets. If these users are the recipients of shared assets, an alert will **not** be triggered.
7. Select **contains** to enter an email domain such as **gmail.com** to exclude all gmail target addresses from triggering alerts.
8. Select **in group** to enter a defined group from your HRIS or IdP or Google Drive apps. If these groups are the sharing target, an alert will **not** be triggered.
9. Select **in** **trusted domains** to exclude all [trusted domain](/docontrol-user-guide/saas-data-monitoring/inventory/inventory-domains.md#trusted-domains) recipients from triggering alerts.
10. Click **Save**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.docontrol.io/docontrol-user-guide/risk-management/alerts/configure-alerts/configure-docontrol-alerts.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
