> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/alerts/view-alerts.md). # View alerts Alerts have more contextual data than simple events. To provide your organization with full context for alerts, the Alerts view is enriched with metadata. Knowing alert details, including actor and target profiles and assets involved for each alert, helps you to make the right decision at the right time, and reduce mean-time-to-repair (MTTR) of any potential data loss.

Each alert generated by DoControl is displayed with enriched metadata and context

## Inbox view The alert inbox view on the left gives you a high-level view of all DoControl alerts generated across your organization's SaaS apps. Each item represents an alert with its metadata: name, severity, date and time it was triggered, and the originating SaaS app. From this view, you can assign a team member to the alert and change its status. Clicking any alert in the inbox displays its details on the right.

High-level view of alerts across all your organization's SaaS apps

Important icons in the alerts inbox include:

Icon	Example	Description
New alerts		Displays the number of active new alerts. The number of new alerts changes when: Additional new alerts are displayed when the DoControl platform is refreshed A user changes the alert status from New to another lifecycle status (in progress, suppressed or resolved)
Assigned user		DoControl user who is assigned to handling the alert
SaaS app		App from which the alert was triggered
Alert status		Stage of alert in the investigation process: new, in-progress, suppressed, resolved, or auto-resolved. If an alert was auto-resolved by DoControl, the date and time are displayed when you hover over the alert status.
Severity level		An indication of how risky the alert is (low, medium, high). This parameter is fully customizable.

{% hint style="success" %} To minimize the number of new alerts, we recommend you change the **New** status to the relevant lifecycle status as you handle alerts (in progress, suppressed or resolved). {% endhint %} ## Alert summary DoControl provides you with an overview about what happened, by who, and the estimated risk. The highlights for each triggered alert include:

Alert parameter	Description
Alert type	DoControl alert name and number, beginning with the prefix DC. For example: Burst download by about-to-leave employee DC36 Click the DC link to open the DoControl Alert Specifications. This document includes a comprehensive description of all DoControl alert parameters for each alert type.
Severity level	An indication of how risky the alert is (low, medium, high). This parameter is fully customizable per alert type.
Date and time	The date and time when the alert was generated
Alert ID	Unique identifier for a specific DoControl alert
SaaS app	App from which the alert was triggered
Overview	Summary of the triggered alert, including the name of the actor, the number of files, and the type of activity
Set alert status	Choose the stage of alert in the investigation process: New In progress Suppressed Resolved
Assign team member	Delegate this alert to a DoControl user
Alert distribution	Time when alert was distributed to your organization: Near real-time - Alert is triggered immediately after the event occurs Calculated - Alert is triggered after multiple events occur, as in the case of aggregated alerts
DoControl status	Data complete - The alert snapshot reflects complete data Processing data - Assets are still being processed in DoControl's inventory. Assets were deleted after the alert was triggered: either by the actor, target, or by a remediation action in the workflow. Auto-resolved - Indicates if alert was resolved automatically by DoControl without manual intervention (currently only available for DC6)
Risk and recommendations	The potential damage or data loss that might occur as a result of the triggered event, together with remediation options.
Number of files	Number of company assets that triggered the alert. Click the number to view all involved assets.
File example	Example of an asset that triggered the alert. Click to view asset metadata.
User was terminated	Last day of an employee in your organization
Termination date	Last day (future date) of an about-to-leave employee
User was deleted	Date when employee was deleted from Google Workspace or IdP (Azure Active Directory or Okta)
Private email	External non-corporate collaborators (for example, with a gmail or yahoo account) who can access a specific file
Personal email	Internal user's own personal email account with access to a specific file
4th party	External collaborator who is not part of your organization or 3rd party's organization
MITRE tactic	What tactic was used in this incident? Why did the adversary perform this action? MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques.
MITRE technique	What technique was used in this incident? How did the adversary perform this action? MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques.

## Alert context Drill-down to investigate the full context for triggering an alert. DoControl's comprehensive alert context helps you to understand anomalies and respond more effectively.

| Context parameter | Description | | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Triggering events |

See enriched information for each SaaS event that triggered a specific alert.
View event context for all triggering events

| | Resolving events | See enriched details about the events that helped to auto-resolve a specific alert. See [Resolving events](#resolving-events). | | Sensitive files |

List of all assets that triggered this alert. A file is considered sensitive if:

DoControl's sensitivity model assigns a high score to the file name, or
A user-defined keyword from the sensitive lexical list was detected in the file name

Click View all to see all sensitive assets that triggered this alert.

| | Activity source |

Geographical IP location of the first event that triggered the alert. See Activity source.
Click View events to see all events that triggered this alert.

| | File sensitivity justification |

Reason that file is sensitive can be either:

DoControl's AI-powered rationale for
indicating that the file contains
sensitive or proprietary content, OR
DoControl detected sensitive keywords in the file name that were defined in your alert lexical list

| | Personal email source |

Actor or target's personal email, as:

Defined in IdP, HRIS and SaaS apps, or
Detected with DoControl's email similarity model

| ### Activity source See the geographical IP location of the first event that triggered the alert. DoControl harnesses GeoIP data to correlate and visualize the origin of alert-triggering activity. When you compare the activity source with the actor's job location and access location patterns, you can easily discover potential account takeover risks. Click **View events** to see all events that triggered this alert.

Compare the activity source with the actor's job location and location bounds

### File sensitivity justification To understand why an asset was found to be sensitive, DoControl provides one of these reasons: * DoControl's AI-powered large language model (LLM) found that the file contains sensitive or proprietary content in the file name, OR * DoControl detected sensitive keywords in the file name that were defined in your [alert lexical list](/docontrol-user-guide/risk-management/alerts/configure-alerts.md).

DoControl's AI-powered model detected sensitive or proprietary content in the file name

Sensitive keywords were detected in the file name

The file sensitivity justification is displayed for these alerts: * DC3 - External sharing of sensitive files * DC6 - Public sharing of sensitive files * DC7 - Shared sensitive file with private email * DC8 - Shared sensitive file with personal email * DC11 - External user publicly shared sensitive files * DC105 - Unprotected sensitive cloud recording is public ### Personal email source The personal email source indicator signals unauthorized sharing with an employee's personal email, even when work and personal emails are entirely different.

Personal emails are collected from various sources, including declared personal emails in HRIS, IdP, and SaaS apps, as well as through DoControl’s proprietary algorithm for undeclared or unlisted emails. The personal email source is displayed for these alerts: * DC8 - Shared sensitive file with personal email * DC30 - Possible former employee accessed assets * DC34 - Possible former employee publicly shared * DC35 - Possible former employee externally shared ## Actor info You can find out details about the actor who shared the asset:

Actor info metadata	Description
Email	DoControl differentiates between a user and an app triggering an alert on the user's behalf. Email of the actor who triggered the alert, or App that triggered a Google alert on behalf of an actor. These alerts might be caused by shadow apps acting in a user's name.
User type	Internal (within the organization) or external.
Employment status	Active or inactive. This data is extracted from an HR system, such as BambooHR.
Job title	Actor's title. The accuracy of this data might vary due to its web-based nature.
Employment type	User's employment type as updated in Okta or HRIS: Full-time, part-time or contractor
Department	Group in the organization
Watchlist	If this user is in the identity watchlist or not. If yes, the user's avatar is also tagged with the watchlist icon. Users in the watchlist can be monitored via workflows.
Risk trend	Hover to view the increase or decrease in the actor's risk score over the last 30 days
Frequent access patterns	User's system activity from the last 90 days: App - SaaS app that is most frequently accessed by the user Operating system - User's device that is most frequently accessed Browser - Browser that is most frequently accessed by the user Location bounds - Most frequently and least frequently accessed locations Suspicious IPs - IPs are anonymous (VPN/Tor/proxy) or used for hosting. Click View all to see frequent access patterns in Identities.
Actor risk breakdown	View the risk elements contributing to the user's risk score over the last 30 days (updated every 12 hours): Latest alerts - Number of active or archived alerts triggered by the actor Latest workflows - Number of workflows triggered by the actor Risky shadow apps - Number of risky shadow apps currently installed by the actor Admin roles - Number of admin roles the actor holds in all integrated SaaS apps DLP exposure - Total risk score increases according to the number of Google or Slack assets with highly sensitive file names
Roles in apps	Number of roles the actor has in SaaS apps used by the organization. Click the number to view all roles, for example, Global administrator
Active alerts	Click to display other alerts triggered for the same actor

## Target info Find out details about the target who received the asset.

Target info metadata	Description
Email	Email address of the target
User type	If target is internal (within the organization) or external
Active alerts	The number of active alerts that involve this specific target Click the link to view all alerts where a specific actor shared with this target
Actors who shared with this target	Number of actors who shared assets with this target Click the link to view the email addresses for each actor
Email familiarity	How often your organization has previously shared assets with this email address: Never seen - Your organization has never shared assets with this email address. Unfamiliar - Your organization has previously shared assets with this email address, but very rarely. Familiar - Your organization has consistently shared assets with this email address. Very familiar - Your organization has consistently and extensively shared assets with this email address. N/A - Not calculated for legacy alerts.
Domain familiarity	How often your organization has previously shared assets with this domain: Never seen - Your organization has never shared assets with this domain. Unfamiliar - Your organization has previously shared assets with this domain, but very rarely. Familiar - Your organization has consistently shared assets with this domain. Very familiar - Your organization has consistently and extensively shared assets with this domain. N/A - Not calculated for legacy alerts.
View user	Open the Identities card for the target user

{% hint style="info" %} Domain and email familiarity require at least **one week** of events to display target info metadata. In the first week that your organization is connected to DoControl, all domains and emails are indicated by default as `never seen`. **For example**: The ACME company connects to DoControl. Every day, users share with . For the first week, both (email) and x.com (domain) are indicated as `never seen`. It takes up to a week for an email or domain to get a familiarity rating. {% endhint %} ## Malicious domain info Details for malicious domain alerts are displayed in the actor or target info, depending if the asset was shared by or with a malicious domain.

Alerts are triggered when assets are shared by or with malicious domains

Malicious domain metadata	Description
Domain	Name of domain
Domain type	Type of malicious domain, as detected by VirusTotal
VirusTotal report	Number of VirusTotal vendors who tagged the domain as malicious, suspicious, harmless, or undetected
Community votes	Number of VirusTotal community members who tagged the domain as malicious, suspicious, harmless, or undetected
Threat name	Name of the detected threat
Redirection chain	Redirected URL

## Triggering events Each alert in DoControl is triggered by a single SaaS event or multiple events. An event occurs when a user performs an action in a SaaS platform, and the details are sent to DoControl. User actions include viewing, editing, downloading, sharing or renaming a file. Examples of events that can trigger alerts include: * Aggregated events of a single action carried out by a user, such as sending numerous assets to a personal Gmail account, or publicly sharing large quantities of assets * Employees about to be terminated downloading files * External users accessing inactive files Click **View event context** to display enriched information for each event that triggered a specific alert, including related events that occurred before and after the anomalous activity.

Information is displayed for each event that triggered an alert

For each event triggering an alert, DoControl displays these parameters:

Event parameter	Description
Date and time	Date and time (hour, minute, second) when event was triggered.
App	SaaS app where the event took place
Event type	Type of event, such as download, change user access, or SSPM
Asset	Link to the asset involved in the event
Event JSON	Opens JSON file in Events page

## Resolving events Auto-resolved alerts can be resolved by a single SaaS event or multiple events. An event occurs when a user performs an action in a SaaS platform, and the details are sent to DoControl. An event that can resolve alerts is when a user changes the document visibility so the document is no longer publicly shared. Click **Resolving events** to display enriched information for each event that resolved a specific alert.

Information is displayed for each event that resolved an alert

For each event resolving an alert, DoControl displays these parameters:

Event parameter	Description
Date and time	Date and time (hour, minute, second) when event was triggered
App	SaaS app where the event took place
Event type	Type of event, such as Access control list changed
Asset	Link to the asset involved in the event
Event JSON	Opens JSON file in Events page

{% hint style="info" %} Auto-resolved alerts are currently supported for DC6: Public sharing of sensitive files in Google Drive. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/risk-management/alerts/view-alerts.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.