> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/identities/identity-watchlist.md).
# Identity watchlist
With DoControl's Identity watchlist, you can proactively monitor internal users in a centralized place, and detect potential threats before they escalate into security incidents. Examples of internal users who warrant watchlist monitoring include:
* Users with a history of suspicious behavior or terms of service violations
* Employees who are assigned to a performance improvement plan (PIP)
* Users who have demonstrated unusual usage patterns that require closer scrutiny
DoControl's Identity watchlist is an early warning system that flags unusual behavior patterns among your users. It gives you instant visibility into account compromise or insider threats for high-risk users. The watchlist allows your security team to prioritize its investigation efforts by focusing on users who pose the greatest potential risk, without having to manually search and check individual users at regular intervals.
The watchlist consolidates all associated emails (work, personal, and other) from multiple sources into a single identity. DoControl uses a proprietary mechanism to identify unlisted or undeclared personal emails.
{% hint style="success" %}
DoControl's Identity watchlist is dynamic: if new personal or work emails are discovered for a user in the watchlist, both the user's identity and the watchlist are automatically updated with all associated emails.
{% endhint %}
## Add users to watchlist
You can add internal users, but not external users, to a watchlist.
You can add users **in bulk** to a watchlist, for up to a maximum of **500 users**. If you try to add more than 500 users, only some users will be added to the watchlist.
{% hint style="danger" %}
You need to be an admin or super admin user to add users to a watchlist.
{% endhint %}
You can add users to the watchlist in 2 ways:
1. Open the Identities module.
2. Filter and select the users you wish to add to the watchlist, for up to 500 users.
3. Click **Add to watchlist**.
4. Proceed to [monitor your watchlist users](#monitor-users-in-watchlist) via workflows.
OR
1. In the Identities module, open a specific user who is in the watchlist.
2. Click the **watchlist** icon to add the user to the watchlist.
3\. Proceed to [monitor your watchlist users](#monitor-users-in-watchlist) via workflows.
## Remove users from watchlist
You can remove users **in bulk** from a watchlist, for up to a maximum of **500 users**. If you try to remove more than 500 users, only some users will be removed from the watchlist.
{% hint style="danger" %}
You need to be an admin or super admin user to remove users from a watchlist.
{% endhint %}
You can remove users from the watchlist in 2 ways:
1. Open the Identities module.
2. Filter and select the users you wish to remove from the watchlist, for up to 500 users.
3. Click **Remove from watchlist**.
OR
1. In the Identities module, open a specific user who is in the watchlist.
2. Click the **watchlist** icon to remove the user from the watchlist.
## View users in watchlist
The Identities dashboard shows you at a glance how many users are in your watchlist:
#### To view users in your watchlist:
1. Open the Identities module.
2. In the filter bar, click **View users in watchlist** .\
All users in the watchlist are displayed in a centralized list.
## Monitor users in watchlist
After you add users to a watchlist, you can start monitoring them via workflows:
* [Add a watchlist condition to your workflows](#add-a-watchlist-condition-to-workflows)
* [Leverage DoControl's predefined playbooks for watchlist monitoring ](#use-watchlist-monitoring-playbooks)
### Add a watchlist condition to workflows
When defining your workflow, you can add a condition that specifies users who are in the watchlist.
1. Select the relevant Google Drive trigger (for example, change user access or download).
2. Add a condition to the trigger: `Actor email` or `Get actor email in watchlist`. The workflow runs only for users who are in the identity watchlist.
3. Alternatively, you can define a workflow condition for users who are **not** in the watchlist.
### Use watchlist monitoring playbooks
DoControl provides you with out-of-the-box playbooks to monitor and remediate overexposure that is initiated by watchlist users:
* [Monitor and remediate watchlist users who share with personal emails](#monitor-and-remediate-watchlist-users-who-share-with-personal-emails)
* [Monitor downloads by watchlist users](#monitor-downloads-by-watchlist-users)
* [Monitor restricted file download in Slack by watchlist users](#monitor-restricted-file-download-in-slack-by-watchlist-users)
#### **Monitor and remediate watchlist users who share with personal emails**
When a watchlist user shares Google files with his/her own personal email, their manager is notified and any personal emails are removed from file sharing permissions.
#### **Monitor downloads by watchlist users**
When a watchlist user downloads a Google Drive file, the file is scanned to check for sensitive content (PII). If PII is found, the SecOps team is notified.
#### Monitor restricted file download in Slack by watchlist users
When a watchlist user downloads a restricted file containing sensitive keywords from the customized lexical list, a notification is sent to the SIEM via webhook, and the SecOps team is notified.
#### To leverage watchlist monitoring playbooks:
1. In DoControl, select **Workflows > Playbooks**.
2. For **App**, select Google Drive.
3. For **Category**, select Identity risk management.
4. If necessary, customize the email or Slack notifications and save the workflow with a new name.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.docontrol.io/docontrol-user-guide/risk-management/identities/identity-watchlist.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
icon to add the user to the watchlist.
