> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/alerts/define-alert-triggered-workflows.md).
# Define alert-triggered workflows
For any high-risk event that occurs and triggers an alert, you can define an automated workflow to run in the background and remediate the event in near real-time. By binding a workflow to a specific alert, you can close the remediation loop faster and ensure better risk coverage.
An alert can also be triggered by an aggregation of events. For example, if an about-to-be-terminated employee in your organization downloads multiple files, these events trigger a burst download alert, which in turn triggers an automated workflow.
As part of the automated workflow for handling alerts, you can automatically implement remediation actions, such as notifying HR or Dev Ops teams, removing public sharing links, or changing the asset owner.
Select a predefined playbook to run an alert-triggered workflow
## Define an alert-triggered workflow
You can define an alert-triggered workflow from the full catalog of DoControl alerts. Following is an example of an alert-triggered workflow.
1. Click the **New workflow** button, and select the event-based workflow type, or click **Playbooks**.
2. In the **App** field, select **DoControl.**
3. For the **Trigger**, select Alerts and choose an alert type from the DoControl alert catalog - for example, Public sharing of sensitive files (DC6).
4. From **Flow control,** add a **Conditional** step; for example:
* Retrieve the actor's email if it's not in a trusted domain.
* Verify if the asset was shared on Google Drive (`Get application` contains GOOGLE\_DRIVE)
* Exclude low-severity alerts (`Get severity` doesn't contain LOW)
5. If true, add a **Notify in Slack** step to send a message to the SecOps team.
6. Select **Actions > Remediate > Google Drive > Remove sharing links** to remove the publicly shared link from the asset.
Example of an alert-triggered workflow
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.docontrol.io/docontrol-user-guide/risk-management/alerts/define-alert-triggered-workflows.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
