> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/identities/identity-card/access.md).

# Access

DoControl monitors your user access patterns, and highlights any anomalous activity that deviates from normal user behavior. Unusual access patterns from different devices, locations or IPs might indicate unauthorized or suspicious activity. 

{% hint style="warning" %}
To monitor Okta user events, or view access events in Identities, make sure you [create event hooks](/docontrol-user-guide/integrations/integrations-okta.md#create-an-event-hook-endpoint) when you integrate DoControl with Okta.
{% endhint %}

Knowing your user access data enhances your organizational security in several ways:

* **Early threat detection -** By continuously monitoring user behavior, DoControl enables you to quickly identify potential security breaches or account compromises. Unusual login attempts, such as those from unfamiliar locations or outside normal working hours, can be flagged immediately, allowing for rapid response to potential threats. 
* **Insider threat detection** - User behavior analysis of unusual patterns in data access or user activities helps to identify potential insider threats, and prevent sensitive data exfiltration and even cyberattacks.
* **Prevention of unauthorized access -** Analyzing user access patterns helps to detect and prevent unauthorized access attempts, including brute force attacks and the use of stolen credentials.
* **Improved compliance** - DoControl enables you to implement data access policies, track user activity, and generate audit logs to meet regulatory requirements.
* **Visibility and control** - DoControl provides extensive visibility into user activities across various SaaS applications, offering detailed insights into logs and security settings. This centralized control facilitates more effective management of user access and permissions.

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FwobC41SdAAnWWR1RpfFi%2Faccess%20tab.png?alt=media&amp;token=0496ec28-e1aa-4965-9176-1373e7480fc3" alt=""><figcaption></figcaption></figure>

### Frequent access patterns

View the main patterns of a user's system activity and behavior from the last 90 days, including the most frequently accessed location, app, device and browser.

Any suspicious location and IP are highlighted, since unusual IPs or infrequent locations might indicate account compromise.

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F1GppiXftOsk6MJpT0AwF%2Ffrequent%20access%20pattern.png?alt=media&amp;token=2a31bc93-ac0b-4ed8-83cc-98ab839b5448" alt=""><figcaption></figcaption></figure>

Frequent access patterns include these parameters:

<table><thead><tr><th width="314">Access parameter</th><th>Description</th></tr></thead><tbody><tr><td>App</td><td>SaaS app that is most frequently accessed by the user.</td></tr><tr><td>Operating system</td><td>User's device that is most frequently accessed. </td></tr><tr><td>Browser</td><td>Browser that is most frequently accessed by the user. </td></tr><tr><td>Access locations</td><td>View the map to see the distribution of a user's geographical access points.</td></tr><tr><td>Location bounds</td><td><ul><li><strong>Most frequently accessed location</strong> - Country from where the user accessed the system the most.</li><li><strong>Least frequently accessed location</strong> - Country from where the user accessed the system the least.</li></ul></td></tr><tr><td>Suspicious IPs</td><td><ul><li>IPs are anonymous (VPN/Tor/proxy) or used for hosting. </li><li>Access from a malicious IP address is a critical security risk </li></ul></td></tr><tr><td>Access map</td><td>Geographical distribution of the user's IP addresses from the most frequent to the least frequent</td></tr></tbody></table>

### Access-related events

View a user's login, logout and MFA access events from the last 90 days. Access-related events include these parameters:

| Access-related event | Description                                                                             |
| -------------------- | --------------------------------------------------------------------------------------- |
| Date and time        | When the event occurred                                                                 |
| App                  | SaaS app where the event occurred                                                       |
| Event type           | Login, logout or MFA access event                                                       |
| Device               | Device where the event occurred                                                         |
| Browser              | Web browser on which the event occurred                                                 |
| Location             | City and country where the event occurred                                               |
| IP                   | The IP address of the event. If anonymous, the IP address is [flagged](#suspicious-ip). |
| View                 | Click the **View** icon to inspect a detailed event log                                 |

### Suspicious IP

High volumes of login attempts or error responses from a particular IP address may indicate brute force attacks or other malicious activities. DoControl flags a suspicious IP when detecting a:

* **VPN** - Hides user's real IP and location by encryption and rerouting&#x20;
* **Tor** - Reroutes traffic through volunteer-operated servers with multiple encryption layers
* **Hosting** - Hosting for websites with sensitive content that prioritizes user privacy&#x20;
* **Proxy** - Intermediary between user and the internet that hides user's real IP address

<div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FxdGBSBeSYENtrAAagsWh%2Fsuspicious%20IP.png?alt=media&amp;token=3f31c334-6746-4dae-af68-5b6e076054cb" alt=""><figcaption></figcaption></figure></div>

### Filtering access-related events

You can filter access-related events to pinpoint specific use cases of suspicious or potential risky behavior:

| Filter       | Description                               |
| ------------ | ----------------------------------------- |
| SaaS         | SaaS app where the event occurred         |
| IP           | The IP address of the event               |
| Access event | Login, logout or MFA access event         |
| Device       | Device where the event occurred           |
| Browser      | Web browser on which the event occurred   |
| Location     | City and country where the event occurred |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/risk-management/identities/identity-card/access.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.