> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/posture/high-level-saas-posture.md). # High-level SaaS posture View your organization's SaaS security posture in a single pane of glass In a single pane of glass, get a high-level overview of your organization's current SaaS security posture. Focus on the main vulnerabilities and security risks in your organization: * Drill-down to investigate any potential risks * Generate an [ROI report](/docontrol-user-guide/risk-management/posture/risk-and-roi-report.md) as a PDF This unified view of SaaS activity is based on end-user activity events and asset metadata across all your SaaS applications. High-level SaaS posture allows you to discover the main risks of your assets and shadow apps, and view recent alerts and remediation actions. {% hint style="warning" %} * As a prerequisite to viewing high-level SaaS posture, you need to integrate DoControl with [Google Workspace](/docontrol-user-guide/integrations/integrations-google-drive.md) or [Slack](/docontrol-user-guide/integrations/slack.md). * Data is refreshed every few hours. {% endhint %} ## Overview View high-level metrics about your SaaS assets. The total number of assets in Google Workspace and Slack is displayed, as well as the increase or decrease in total number of assets compared to the previous month.

{% hint style="success" %} Click the asset number for a specific app to open the filtered [asset inventory](/docontrol-user-guide/saas-data-monitoring/inventory/inventory-assets.md) page for that app. {% endhint %} ## Integrations See all your organization's SaaS apps that are integrated with DoControl, and the date you connected each SaaS app.

All your SaaS apps integrated with DoControl

For any app, including those that are not yet connected, click the app icon to open the [Integrations](#integrations) page for that specific app. ## High-level risk posture Get a high-level summary of the potential SaaS security risk in your organization, based on data exposure.

High-level risk posture across your organization's SaaS apps

The high-level risk posture for your organization displays these risky areas: * [Active alerts](#active-alerts) * [Access insights](#access-insights) * [Sensitive data exposure](#sensitive-data-exposure) * [Potentially risky events](#potentially-risky-events) See how DoControl mitigates your risk in these areas: * [Workflow coverage](#workflow-coverage) * [Identities](#identities) * [Misconfigurations](#misconfigurations) * [Workflows](#workflows) * [Exposure analysis](#exposure-analysis) * [Shadow apps](#shadow-apps) * [Activity feed ](#activity-feed) ### Active alerts Get alert insights from anomalous activities across all your organization's SaaS apps. Alert data is refreshed every hour.

Alert parameter	Description
Total active alerts	The number of new or in-progress active alerts with the increase or decrease compared to the previous 30 days
Severity	The number of alerts according to severity level (high, medium, low).

{% hint style="success" %} Click any severity category to open the [Alerts](/docontrol-user-guide/risk-management/alerts.md) page filtered by that category. {% endhint %} ### Access insights View significant highlights of unauthorized data access or data exfiltration across your Google and Slack apps. These findings might pose a risk to your organization if left unremediated. Exposure insight data is refreshed every hour.

Access insights are displayed for these categories:

Access insight category	Description
Former employees	Number of terminated employees with access to your Google assets via their personal email accounts. You need to be integrated with an HRIS or Okta to display this data.
External users	Number of users outside your organization with access to your Google and Slack assets
Private accounts	Number of external collaborators with a non-corporate email account, such as gmail or yahoo, with access to your Google and Slack assets
Organizations	Number of external domains that have access to your Google assets

{% hint style="info" %} Click any insight to open its filtered view in Google or Slack. {% endhint %} ### Sensitive data exposure Assess the exposure risk of assets in your organization, and see how and where your organization's sensitive assets are exposed according to sharing status. The total number of exposed sensitive assets across Google and Slack is shown with the increase or decrease in data exposures compared to the previous month. Data exposure data is refreshed every hour. {% hint style="info" %} Sensitive assets have a **high** sensitivity ranking based on DoControl's proprietary evaluation of the asset name. {% endhint %}

See how your sensitive assets are exposed according to sharing status

Your organization's sensitive data exposure is shown for these categories:

Icon	Data exposure category	Description
	Public assets open to the world	Number of Google and Slack assets that can be accessed by anyone with a link, without authentication.
	Assets shared with external collaborators	Number of Google and Slack assets that can be accessed by specific users outside your organization with a link after authentication.
	Assets shared inside the organization	Number of Google and Slack assets that can be accessed by specific internal users with or without a link.

{% hint style="success" %} Click any data exposure category to open the Assets page for [Google](/docontrol-user-guide/saas-data-monitoring/inventory/inventory-assets/google-drive-assets.md) or [Slack](/docontrol-user-guide/saas-data-monitoring/inventory/inventory-assets/slack-assets.md), already filtered by the selected status. {% endhint %} ### Potentially risky events View the main user actions in your integrated SaaS apps that might cause data exposure or exfiltration. The number of potentially risky events is shown out of the total number of events detected over the last 30 days. Potentially risky event data is refreshed every 24 hours.

See how many risky events of a specific type occurred on any date in the last 30 days

The line graph displays risky events according to these categories:

Risky event category	Description
Public share	Assets made accessible to anyone via a link or web publishing
External share	Assets shared with external collaborators via sharing permissions
User operations	User activity that poses an IT or security risk, such as login from a non-trusted IP or disabling MFA
Upload/download	Assets uploaded to or downloaded from your organization

{% hint style="success" %} * Hover over any point in the line graph to view the number of risky events for a specific category on a specific date. * Click any category on the right to open the [Events](/docontrol-user-guide/saas-data-monitoring/events.md) page with all filtered events in that category. {% endhint %} ## Workflow coverage View the number of potentially risky events covered by DoControl workflows out of the total number of risky events detected over the last 30 days. Data is refreshed every hour. The monthly trend shows the increase or decrease in the percentage of workflows that covered risky events compared to the previous month. Data is refreshed every 24 hours. {% hint style="warning" %} * To display workflow coverage, your organization first needs to configure active workflows. * To display the monthly trend, your organization needs to be integrated with DoControl for at least 30 days. {% endhint %}

DoControl workflow coverage for risky events

{% hint style="success" %} To close your coverage gap, click on a recommended playbook, customize if necessary, and activate the workflow. {% endhint %} ## Identities Get an overview of your risky identity posture for all internal users in your organization. See the number of risky identities out of the total number of identities in your organization.

* **Distribution of risky users** - At a glance see the percentage and number of internal users per risk bracket (critical, high, medium, low). Click any risk bracket to view all identities belonging to that group. * **Risky user spikes** - View the top risky users with the greatest risk score increase over the past 7 days. * **Risky departments** - View the risk scores for the riskiest departments in your organization, with an indication if the risk score increased or decreased, or remained the same, over the last 30 days. {% hint style="warning" %} To view your identity posture, you need to be integrated with Google Workspace, and an HRIS (HiBob, \ Deel HR, Workday, SAP SuccessFactors, BambooHR) or Okta. {% endhint %} ## Misconfigurations Get a quick overview of your overall SaaS configuration posture. At a glance, see how your organization’s SaaS settings measure up to compliance standards.

### Compliant security checks View the overall compliance score for your organization:

Compliance parameter	Description
Total score	Overall compliance score for scanned SaaS apps in your organization. This score is based on the number of security checks that DoControl found compliant with industry benchmarks, such as CIS.
Compliant security checks	The number of security checks that meet compliance standards, or passed, out of the total number of scanned security checks. For example, 62 security checks passed out of a total of 291.
Score breakdown	Pass - Number of scanned security checks that are compliant Error - Number of security checks that could not be validated Info - Number of security checks that require manual intervention. Your organization needs to check these compliance parameters. Fail - Number of scanned security checks that aren't compliant
Recently failed	The number of detected misconfigurations in the last 7 days

### Monitored apps For your organization's SaaS apps that are being monitored for compliance, you can view: * Compliance score for each app (currently GitHub and Zoom) * Number of critical and high-severity security checks requiring remediation ## Workflows Discover how DoControl workflows have been addressing your organization's SaaS posture risks over the last 30 days.

The Workflow posture dashboard displays: * [Remediation activity](#remediation-activity) * [End-user interactions](#end-user-interactions) * [Workflow activity](#workflow-activity) ### Remediation activity View the number of remediation actions that were successfully completed across your SaaS apps over the last 30 days.

See how many remediation actions were completed on a specific date

The increase or decrease in the number of remediation actions is compared to the previous month. Data is refreshed every hour. Hover over any point in the graph to view the number of remediation actions that were applied on a specific date. {% hint style="info" %} To view remediation data, your organization needs to have active workflows that include remediation steps. {% endhint %} ### End-user interactions You can view the overall number of end-user responses for Approval or Decision action steps that were run in workflows over the last 30 days. Toggle the dropdown to view a different interaction type: * **Approvals** - An approver approves or rejects the user's action * **Decisions** - An actor chooses between options

Distribution of users' responses when asked to approve actors' actions

The increase or decrease in the number of end-user actions is compared to the previous month. Data is refreshed every hour. ### Workflow activity The total number of workflow executions run across your SaaS apps in the last 30 days is compared to the percentage increase or decrease from the previous month. Data is refreshed every hour.

Workflow executions by status over the last month

The [execution statuses](/docontrol-user-guide/workflows/activity-dashboard.md#workflow-execution-status) for workflows include:

Workflow execution status	Description
Completed	The workflow execution was completed successfully.
In progress	The execution is still running, or is waiting for an action to take place.
Warning	The workflow execution didn’t fail but couldn’t be fully completed due to a non-urgent issue.
Failed	The workflow failed to execute, for example, because of insufficient permissions to execute this action.

{% hint style="success" %} Hover over the graph or legend to highlight the number of workflow executions that were run on a specific date, according to execution status. {% endhint %} ## Exposure analysis View how many of your Google and Slack assets, particularly sensitive assets, were exposed in the last 30 days according to sharing status (public, external, internal). {% hint style="info" %} Sensitive assets have a **high** sensitivity ranking based on DoControl's proprietary evaluation of the asset name. {% endhint %}

Number and type of Google and Slack assets exposed in the last 30 days

### Google Workspace exposure See how many of your Google assets, and in particular sensitive assets, were exposed in the last 30 days according to sharing status (public, external, internal). You can also view the number of external and internal users who collaborated on your assets.

Exposed on Google Workspace	Description
Assets	Number of Google assets exposed according to sharing status
Sensitive assets	Number of Google assets with a high sensitivity ranking (based on asset name) that were exposed
Collaborations	Number of external and internal users who collaborated on your Google assets

### Slack exposure See how many of your Slack files, and in particular sensitive files, were exposed in the last 30 days according to sharing status (public, external, internal).

Exposed on Slack	Description
Files	Number of Slack files exposed according to sharing status
Sensitive files	Number of Slack files with a high sensitivity ranking (based on file name) that were exposed

## Shadow apps Discover the extent of potential risk arising from the shadow apps installed in your organization's SaaS apps, including internal and risky third-party apps.

{% hint style="warning" %} To view shadow app data, your organization needs to leverage DoControl's premium shadow app module. {% endhint %} The Shadow app posture dashboard displays: * [Managed apps](#managed-apps) * [Top risky users](#top-risky-users) * [Risky findings](#risky-findings) ### Managed apps View the total number of shadow apps installed in your organization compared to the previous month. New apps are shown for the last 30 days.

Number of shadow apps in your organization

The types of shadow apps are displayed according to these categories:

Shadow app category	Description
Installed	Total number of installed apps
Reinstalled	Removed apps that were reinstalled by users
Removed	Apps that were removed by your organization
Not installed	Apps that were removed by users

### Top risky users See which users installed the largest number of risky apps vs. their total number of installed apps. Risky apps have a risk score greater than 7.

Users with the highest number of risky apps

### Risky findings Aggregated risk insights show the number of shadow apps in each category, compared to the previous month.

Number of shadow apps per risky category

Click any risky finding to view its filtered apps:

Risky finding category	Description
Abandoned apps	Inactive or dormant apps that weren't used for at least 30 days.
Risky apps	Apps with a risk score between 7-10.
Removed and reinstalled apps	Apps that were removed by DoControl and then reinstalled later by a user.

## Activity feed View the latest alerts for anomalous or risky behavior across all your organization's SaaS apps, with the most recent alert shown first. Alerts are labelled according to their severity level: high, medium or low, and indicated with the name of the actor who triggered the alert. The activity feed is shown from the time you connected to DoControl. {% hint style="success" %} Click the alert to view it in the Alerts page. {% endhint %}

Alert feed for anomalous or risky behavior

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/risk-management/posture/high-level-saas-posture.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.