> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/it-and-security-operations.md).

# IT and security operations

**SaaS security problem**

Organizations that rely solely on login credentials for secure authentication, without MFA (multi-factor authentication), are highly vulnerable to attack. User names and even strong passwords are susceptible to identity theft and can't serve as the only means to protect company data.

**DoControl solution**

DoControl leverages these tools to automatically monitor and remediate IT and security operation risks across a variety of apps:

* [Alerts](#alerts-for-it-and-security-operations)
* [Playbooks](#playbooks-for-it-and-security-operations)

## What's the risk?

Passwords provide the first line of defense against unauthorized access to information in your organization. The stronger the password, the more protected your information is from hackers and malicious software. Users should maintain strong passwords in all their accounts.

A login from a non-trusted IP could indicate a security breach, where a hacker tries to infiltrate your organization via a non-trusted domain.

## Alerts for IT and security operations

DoControl alerts automatically notify your organization when anomalous user behavior occurs. 

SaaS security posture management (SSPM) alert types indicate security risks in SaaS applications; for example, if a user disables the organization’s MFA requirement.

To mitigate security-operation risks in Dropbox, DoControl generates these alerts:

<table><thead><tr><th width="143">Alert type</th><th width="198">DoControl alert name</th><th>Alert description</th></tr></thead><tbody><tr><td>DC82</td><td>MFA disabled for a user</td><td>This alert will trigger when an internal user disables the organization's MFA requirement.</td></tr><tr><td>DC83</td><td>MFA disabled for a team</td><td>This alert will trigger when an internal user disables the MFA login requirement for a team.</td></tr><tr><td>DC84</td><td>Password strength requirements changed for team</td><td>This alert will trigger when an internal user reduces the minimal security requirements for a team's login passwords.</td></tr></tbody></table>

{% hint style="info" %}
For details about DoControl alerts, go to **Help > DoControl Alert Specifications**.
{% endhint %}

### How to remediate alerts?

In the Dropbox admin console, you can enforce an additional layer of security when a team member signs in (such as a two-step verification).&#x20;

## Playbooks for IT and security operations

To address the use cases of IT and security risks across various SaaS apps, you can define automated workflows with DoControl's out-of-the-box playbooks. These playbooks will:

* Notify your security team whenever a suspicious login occurs in Google Workspace or Slack from a non-trusted IP.
* Notify when a new public Teams channel is created, or when Teams web is accessed outside a trusted IP.
* Remediate a suspended employee’s personal email access to Google Drive
* Detect suspicious login attempts from Salesforce
* Notify when external users join private Slack channels, or when unapproved apps are installed in Slack Enterprise

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FmiuauCMY8RRnHyX4mRrf%2FPlaybooks%20IT%20and%20security.png?alt=media&amp;token=d63505c1-0746-4265-843f-fd04b8730e70" alt=""><figcaption><p>Select a predefined DoControl playbook to remediate IT and security operation risks</p></figcaption></figure>

<table><thead><tr><th width="227">Playbook name</th><th width="208.33333333333331">SaaS app</th><th>Playbook description</th></tr></thead><tbody><tr><td><a href="/docontrol-user-guide/risk-management/threat-model-coverage/it-and-security-operations/google-playbooks-for-it-and-security-operations.md#add-external-domain-to-trusted-domain-list-after-file-share">Add external domain to trusted domain list after file share</a></td><td>Google Drive</td><td>When a Google Drive asset is shared with a non-trusted domain, the user is given the choice to approve the share, remove the collaborator, or ask the SecOps team to add the domain to the organization's list of trusted domains.</td></tr><tr><td><a href="/docontrol-user-guide/risk-management/threat-model-coverage/it-and-security-operations/google-playbooks-for-it-and-security-operations.md#notify-about-suspicious-login-from-non-trusted-ip">Notify about suspicious login from a non-trusted IP</a></td><td>Google Workspace</td><td>When someone logs into Google Workspace from a non-trusted IP, the Security Ops team is automatically notified by email.</td></tr><tr><td><a href="/docontrol-user-guide/risk-management/threat-model-coverage/it-and-security-operations/google-playbooks-for-it-and-security-operations.md#remediate-suspended-employees-personal-email-access-to-google-drive">Remediate suspended employee's personal email access to Google Drive</a></td><td>Google Workspace</td><td>When a suspended Google user shares files with their personal email, DoControl automatically remediates the shared files. If the remediation cannot start, the Security Ops team is notified by email.</td></tr><tr><td><a href="/docontrol-user-guide/risk-management/threat-model-coverage/it-and-security-operations/salesforce-playbooks-for-it-and-security-operations.md#detect-login-from-disabled-accounts">Detect login from disabled accounts</a></td><td>Salesforce</td><td>When a blocked or inactive user tries to log into Salesforce from a disabled account, the Security Ops team is automatically notified by email and Slack.</td></tr><tr><td><a href="/docontrol-user-guide/risk-management/threat-model-coverage/it-and-security-operations/salesforce-playbooks-for-it-and-security-operations.md#detect-suspicious-login-attempt">Detect suspicious login attempt</a></td><td>Salesforce</td><td>When a user tries to log into Salesforce from a non-trusted IP, not allowed country, with a failed login or unsecured session, the Security Ops team is automatically notified by email and Slack.</td></tr><tr><td><a href="/docontrol-user-guide/risk-management/threat-model-coverage/it-and-security-operations/salesforce-playbooks-for-it-and-security-operations.md#notify-on-suspicious-api-query-in-salesforce">Notify on suspicious API query in Salesforce</a></td><td>Salesforce</td><td>When a suspicious API query is detected by Salesforce, the Security Ops team is automatically notified by Slack and the Datadog logs are sent.</td></tr><tr><td><a href="/docontrol-user-guide/risk-management/threat-model-coverage/it-and-security-operations/slack-playbooks-for-it-and-security-operations.md#notify-when-an-external-user-joins-a-private-channel">Notify when an external user joins a private channel</a></td><td>Slack</td><td>When an external user joins a private Slack channel, the Security Ops team is automatically notified by email.</td></tr><tr><td><a href="/docontrol-user-guide/risk-management/threat-model-coverage/it-and-security-operations/slack-enterprise-playbooks-for-it-and-security-operations.md#notify-about-suspicious-login-from-non-trusted-ip">Notify about suspicious login from a non-trusted IP</a></td><td>Slack Enterprise</td><td>When someone logs into Slack Enterprise from a non-trusted IP, the Security Ops team is automatically notified by email.</td></tr><tr><td><a href="/docontrol-user-guide/risk-management/threat-model-coverage/it-and-security-operations/slack-enterprise-playbooks-for-it-and-security-operations.md#notify-when-an-unapproved-app-is-installed-in-slack-enterprise">Notify when an unapproved app is installed in Slack Enterprise</a></td><td>Slack Enterprise</td><td>When a Slack Enterprise user installs an app that was not approved by Slack Marketplace, the Security Ops team is automatically notified by email.</td></tr><tr><td><a href="/docontrol-user-guide/risk-management/threat-model-coverage/it-and-security-operations/teams-playbooks-for-it-and-security-operations.md#notify-on-new-public-teams-channel">Notify on new public Teams channel</a></td><td>Teams</td><td>When someone creates a new public channel in Teams, the Security Ops team is automatically notified by email and a message in Teams.</td></tr><tr><td><a href="/docontrol-user-guide/risk-management/threat-model-coverage/it-and-security-operations/teams-playbooks-for-it-and-security-operations.md#notify-on-web-access-outside-of-trusted-ips">Notify on web access outside of trusted IPs</a></td><td>Teams</td><td>When someone logs into Teams via a non-trusted IP, the actor is asked to verify his or her login. If the actor doesn't confirm their login, the Security Ops team is notified by email.</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/it-and-security-operations.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.