> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/alerts/filter-alerts.md). # Filter alerts To make it easier to focus your investigation on specific alerts, you can refine your alert view. DoControl alerts can be filtered according to a variety of parameters: * [Active vs archived](#filter-active-vs-archived-alerts) * [Severity level](#filter-alerts-by-severity-level) * [Alert status](#filter-alerts-by-status) * [SaaS app](#filter-alerts-by-saas-app) * [More filters](#more-alert-filters) ## Filter active vs archived alerts All alert filters are applied to a subset of either active or archived alerts. Select if you want to view any filtered subset for active **or** archived alerts. #### To view only archived alerts: 1. Go to the Alert page. 2. In the dropdown, select **Archived** **alerts**. #### To view only active alerts: 1. Go to the Alert page. 2. In the dropdown, select **Active** **alerts**.
## Filter alerts by severity level Alerts are categorized by these levels of severity:
Severity levelDescription
LowUnusual user activity, such as accessing inactive files or when a user shares files extensively.
MediumAnomalous user activity considered to be risky, such as allocating public access to assets.
HighThe highest severity level. Anomalous user activity that's considered highly risky, such as sharing sensitive files externally or to private emails
{% hint style="info" %} To assign severity levels to alerts, see [Configure alerts](/docontrol-user-guide/risk-management/alerts/configure-alerts.md). {% endhint %} #### To filter alerts according to severity: 1. Click the **Severity** dropdown filter. 2. Select one of these severity levels: High, Medium, Low or All. \ Only alerts with the selected severity level are displayed.
{% hint style="info" %} Either active or archived alerts can be filtered and displayed according to severity. {% endhint %} ## Filter alerts by status To better focus on alerts during a specific stage of the investigation process, you can filter alerts by status: 1. Go to the Alerts page. 2. Click the arrow in the **Status** dropdown to select the relevant alert status: New, In progress, Suppressed, Resolved, or Auto-resolved.
{% hint style="info" %} Either active or archived alerts can be filtered and displayed according to alert status. {% endhint %} ## Filter alerts by SaaS app You can filter alerts according to your integrated SaaS apps. 1. Go to the Alert page. 2. In the **App** filter, select the relevant SaaS app for which to view alerts.\ You can select any number, or all, integrated SaaS apps.\ \ ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FwQ3wP3Y8B0aciibMxG9f%2Ffilter%20apps.png?alt=media\&token=be074b5e-34b1-45e5-9aa3-a5741884d86a) {% hint style="info" %} Either active or archived alerts can be filtered and displayed according to SaaS app. {% endhint %} ## More alert filters You can filter either active or archived alerts according to a variety of parameters.
FIlter parameterDescription
ActorThe user who triggered the event. For example, a single user or a group of users.
Alert category

Alert grouping based on the event that triggered it, for example:

  • External sharing
  • File download
  • Former employee
  • Leaving employee
  • Malicious domain
  • Private email
  • Public sharing
  • SSPM
Alert IDUnique identifier for each DoControl alert
Alert typeDoControl configurable alert that supports a specific use case across various SaaS apps, such as DC6: Public sharing of sensitive files
Date A specific date or date range when the alerts were generated
DepartmentThe organizational unit the actor belongs to
MITRE tactic

The reason why an adversary performs an action, or the adversary's tactical goal, for example:

  • Collection
  • Credential access
  • Exfiltration
  • Initial access
  • Persistance
TargetFor whom the event was intended. For example, the user who was sent a file
#### To filter alerts: 1. Select active or archived alerts. 2. Click **Filters**. 3. Select the relevant filter: * **Actor** - Enter full or partial text for the actor's name. * **Alert category** - Enter the relevant values in the Include and Exclude fields. * **Alert ID** - Enter full or partial text for the alert identifier. * **Alert type** - Select the relevant alert types from the dropdown list. * **Date** - Select an exact date, before or after date, or date range. * **Department** - Enter the actor's department. * **MITRE tactic** - Enter the relevant values in the Include and Exclude fields. * **Target** - Enter full or partial text for the target's name. 4. Click **Add filter** to add another parameter. 5. Click **Apply**. {% hint style="success" %} After you filter alerts, you can select the entire subset of filtered alerts to perform a bulk action. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/risk-management/alerts/filter-alerts.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.