> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/asset-monitoring-and-isolation.md). # Asset monitoring and isolation **SaaS security problem** SecOps teams today struggle to find the right balance between productivity and end-user convenience on one hand, and security on the other hand. As a result, sensitive data, including intellectual property and personally identifiable information (PII), is vulnerable to over-exposure and potential loss. Almost every organization has company-confidential files, such as financial and HR documents, that are stored and shared on various SaaS apps. While it's standard practice to collaborate on company documents, collaboration significantly increases the volume of highly-sensitive data vulnerable to exfiltration. When excess permission privileges are granted to external users outside your organization, or sensitive data is publicly shared, then unauthorized access to sensitive data can leave organizations open to fines for non-compliance, competitive threats, and brand damage. By identifying highly-sensitive assets within your SaaS ecosystem, you can easily track their digital footprint and if necessary, isolate these assets from excessive exposure. **DoControl solution** DoControl enables you to track access changes and monitor movement around sensitive or company-confidential documents, such as a shared Finance Google Drive, or SharePoint or Teams site. For example, DoControl notifies your SecOps team whenever specific confidential files are shared, uploaded or downloaded. In addition, DoControl automatically remediates external or public sharing of sensitive or confidential files, by removing external collaborators or sharing links. This helps to protect data integrity and minimize the risk of data overexposure. To safeguard sensitive and company-confidential content within SaaS platforms, DoControl leverages these tools to automatically monitor and isolate specific assets: * [Google Drive playbooks](/docontrol-user-guide/risk-management/threat-model-coverage/asset-monitoring-and-isolation/google-drive-playbooks-for-asset-monitoring-and-isolation.md) * [Slack playbooks](/docontrol-user-guide/risk-management/threat-model-coverage/asset-monitoring-and-isolation/slack-playbooks-for-asset-monitoring-and-isolation.md) ## What's the risk? Sharing assets externally means they are now accessible to specific users outside of your organization. Publicly-shared assets means they are now accessible to anyone on the web. While that might be OK in some cases, exposing internal or sensitive data increases the risk of data breaches and unauthorized access. External or public sharing can cause significant damage if company-confidential documents reach someone with malicious intent. When your organization has a set of known assets with sensitive or company-confidential content, it's in your interest to protect such content from overexposure. ## Playbooks for asset monitoring and isolation To address the use cases of asset monitoring and isolation across various SaaS apps, you can define automated workflows with DoControl's out-of-the-box playbooks. These playbooks will: * Notify your SecOps teams when specific Google Drive assets are viewed, uploaded, or downloaded. * Change asset owners for specific Google Drive assets. * Automatically remove external collaborators or sharing links from specific Google Drive assets. * Notify your SecOps teams when specific Slack assets are uploaded or shared.

Select a predefined DoControl playbook to implement asset monitoring and isolation

Playbook name	SaaS app	Playbook description
Change asset owner on-demand	Google Drive	When a user triggers a DoControl inventory action to change the asset owner, a new owner is assigned to the Google Drive asset. This inventory action is applicable only on My Drive assets.
Notify on downloading file	Google Drive	When someone downloads a specific file from Google Drive, the Security team is notified in Slack.
Notify on uploading file	Google Drive	When someone uploads a specific file to Google Drive, the Security team is notified in Slack.
Notify on viewing file	Google Drive	When someone views a specific file in Google Drive, the Security team is notified in Slack.
Remediate external sharing in a specific folder	Google Drive	When someone shares an asset from a specific folder in Google Drive with someone who's not from a trusted domain, external collaborators are removed. Both the Security team and actor are notified by email.
Remove public sharing in a specific folder	Google Drive	When someone publicly shares an asset from a specific folder in Google Drive, publicly shared links are removed. Both the Security team and actor are notified.
Remove sharing links on-demand	Google Drive	With this inventory action you can remove all sharing links from selected Google Drive assets for these link types: Public - Removes publicly shared links Organization - Removes organization-wide links
Notify on file sharing in a specific channel	Slack	When someone shares a file in a specific Slack channel, the security team is notified in Slack.
Notify on file upload by specific users	Slack	When a specific user shares a file in a Slack channel, the security team is notified in Slack.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/asset-monitoring-and-isolation.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.