> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/identities/monitor-risk-change.md). # Monitor risk change It can be difficult to understand how, when, and why a user's risk score changed. DoControl gives you full visibility into risk score changes, and notifies you immediately whenever a user's risk score changes. The `Identity risk score changed` event is triggered whenever a user's risk score increases or decreases, even by 1 point. The event is enriched with data, and includes breakdowns of old and new risk scores, allowing you to better understand the reasons for risk spikes. This event type can be leveraged in 2 ways: * [Investigate risk changes](#investigate-risk-changes) - From the Events page, you can investigate changes in a user's risk score. See the full context for the risk change in a JSON file and leverage it in investigations. * [Create workflows for identity risk management](#create-workflows-for-identity-risk-management) - You can define workflows to track risk changes, and automatically notify your security team whenever a user's risk score changes significantly. ## Investigate risk changes DoControl generates an event every time a user's risk score changes, even by 1 point. From the JSON files in the Events page, you can investigate the reasons for changes in a user's risk score: 1. In DoControl, go to **Events**. 2. Under **Filters**, select `Event type includes Identity risk score changed`.

3. For each internal user where the risk score changed, you can compare the old score to the new score. For example:\ `Old score: 48, New score: 99` 4. Click the **JSON** link to see the full data context for risk change and leverage it in your investigations.

Investigate the JSON file for any **Identity risk score changed** event

5. Click the **actor** name to open the Identities risk card for that user.

### Data-rich event context From the Events page, you can investigate changes in a user's risk score. Each **Identity risk score changed** event is displayed with its full context in a [JSON file](#json-example), and includes these parameters:

Identity context	Parameters
User identity	Identity name Identity’s department Job title SaaS app roles Employment status Employment type Emails (personal and work)
Old risk	User's previous risk score with breakdown of risk elements Department or organization’s previous risk score with breakdown of risk elements
New risk	User's current risk score with breakdown of risk elements Department or organization’s current risk score with breakdown of risk elements

### **JSON example** The JSON file for the **Identity risk score changed** event is enriched with data: ``` { "identity_info": { "name": "Guy Rosenthal", "department": "Product", "job_title": "VP Product", "employment_status": "ACTIVE", "employment_type": "FULL_TIME", “emails” :{ "work_emails": { "email1": "gr@docontrol.io", "email2": "gr2@docontrol.io" } “personal_emails”:{ “email1”: “gr11@gmail.com”, “emails2”:”gr88@yahoo.com”, } } }, "old_risk": { "identity": { "score": "80", "risk_elements": { "exposure_level": { "total_assets": "500", "public": "160", "external": "40", "internal": "300" }, "dlp_exposure": "MEDIUM", "VIP": "NONE", "admin": [ { "saas": "google", "role": "super_admin" }, { "saas": "google", "role": "admin" } ], "alerts": { "active": "5", "archived": "0" }, "workflows": "20", "shadow_apps": "4", "employment_status": "ACTIVE", "employment_type": "FULL_TIME" }, "department": { "score": "55", "risk_elements": { "exposure_level": { "total_assets": "100", "public": "60", "external": "40", "internal": "0" }, "dlp_exposure": "LOW", "alerts": { "active": "3", "archived": "0" }, "workflows": "4", "shadow_apps": "2" } } }, "new_risk": { "identity": { "score": "90", "risk_elements": { "exposure_level": { "total_assets": "500", "public": "160", "external": "40", "internal": "300" }, "dlp_exposure": "MEDIUM", "VIP": "NONE", "admin": [ { "saas": "google", "role": "super_admin" }, { "saas": "google", "role": "admin" } ], "alerts": { "active": "5", "archived": "0" }, "workflows": "20", "shadow_apps": "4", "employment_status": "ACTIVE", "employment_type": "FULL_TIME" }, "department": { "score": "55", "risk_elements": { "exposure_level": { "total_assets": "100", "public": "60", "external": "40", "internal": "0" }, "dlp_exposure": "LOW", "alerts": { "active": "3", "archived": "0" }, "workflows": "4", "shadow_apps": "2" } } } ``` ## Create workflows for identity risk management You can leverage DoControl's automated playbooks to define workflows for notifying your security team in these use cases: * [Notify on identity risk spike](#notify-on-identity-risk-spike) * [Notify on identity risk spike for terminated user](#notify-on-identity-risk-spike-for-terminated-user) These workflows are triggered by DoControl's **Identity risk score changed** event, and are displayed in the Workflow list under the DoControl app:

Workflows triggered by a change in identity risk score

### Notify on identity risk spike Notify your security team whenever a user's risk score increases and the user becomes risky. 1. In DoControl, go to **Workflows > Playbooks** and select the **Identity risk management** category.\

2. Select the **Notify on identity risk spike** playbook.

3. Optional: Customize the identity score difference between the old and new risk scores. 4. Optional: Customize the value of the new risk score. 5. Customize the **Notify in Slack** message to send to your security team. ### Notify on identity risk spike for terminated user Notify your security team whenever a terminated user's risk score increases. 1. In DoControl, go to **Workflows > Playbooks** and select the **Identity risk management** category.

2. Select the **Notify on identity risk spike for terminated user** playbook.

3. Optional: Customize the value of the new risk score. 4. Customize the **Notify in Slack** message to send to your security team. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/risk-management/identities/monitor-risk-change.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.