> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/events.md). # Events The Events page is a central workspace for investigating all events in your SaaS ecosystem. It gives you instant context, precision [filtering](/docontrol-user-guide/saas-data-monitoring/events/filtering-events.md), and a consistent view of what users and automations are doing in your SaaS environment. By consolidating activity from multiple SaaS apps into a unified event model, you can investigate suspicious behavior in one place.

The total number of filtered events is displayed next to the dropdown filters

## What's an event? An event represents a single user or system action detected in DoControl or in any integrated SaaS application. Typical events include: * Viewing, editing, or downloading assets * Sharing SaaS assets via public links or with personal emails * Actions taken by DoControl when enforcing policies or remediating {% hint style="info" %} DoControl indicates if events were performed by human or non-human users. See [Actor data](#actor-data). {% endhint %} By indicating events that were initiated by the DoControl platform itself, you can easily distinguish enforcement from end-user behavior at a glance. See [use cases for advanced filtering](/docontrol-user-guide/saas-data-monitoring/events/filtering-events.md#use-cases-for-advanced-filtering). ### Alerts and workflows from events When relevant, an event will trigger additional security measures based on your configuration, for example: * **DoControl alert** - For example, an alert for public sharing of sensitive files * **Defined workflow** - For example, a workflow that performs remediation, notification, or approval steps ### Event details and raw JSON For each event, DoControl provides a consolidated view of user and asset activity gathered from your organization’s integrated SaaS applications. For deeper analysis, all underlying technical fields are attached as a JSON file of the event, allowing you to inspect raw details, troubleshoot integrations, or validate how specific SaaS applications report activity. {% hint style="info" %} * If no date range is selected, events are displayed from the last **24 hours**. * You can search for events that occurred during the last 6 months. {% endhint %} ## Event data Enriched data is displayed for each event according to these columns:
Event columnDetails
Date and timeWhen the event occurred.
Actor

The user who triggered the event:

  • Click the actor's email to open their user profile
  • Risk score of the actor
  • Indication if the actor is on the Identities watchlist
  • Indication if an app or service acted on behalf of the actor
TargetThe recipient of the event, or who the actor shared data with. If the recipient is a Google email alias, the user's real email address is displayed.
AppThe app involved in the event.
AssetThe name of the asset involved. Clicking the link opens the Asset page.
Event typeUser action as defined in the relevant SaaS app
TriggeredNumber of workflows or alerts that were triggered by this event. Click the Workflowsor Alerts icon to view the triggered entities.
Event IDUnique event identifier.
Event JSON Raw details about the event. To copy the JSON file, click the link to first open the JSON file.
{% hint style="success" %} * The **total number** of filtered events is displayed next to the dropdown filters. * To download all displayed events, click the **Export to CSV** icon. You can download up to 50,000 events at a time. {% endhint %} ## Actor data Enriched actor context helps you to better understand how risky an event is. Data about the actor's role, admin level, risk score and actor type (human vs non-human) enables you to distinguish normal from anomalous behavior, significantly reducing false positives for suspicious events. For each actor who triggered an event, you can view high-level identity data:
* **Actor email** - Click to open the actor's identity card * **Watchlist** - Indicates if the actor is being monitored in the Identities watchlist * **Risk score** - Potential risk the user poses to the organization in terms of data loss or exfiltration: * Critical - 80-100 * High - 50-79 * Medium - 30-49 * Low - 1-29 {% hint style="warning" %} To display identity data, you need to enable DoControl's Identity solution by integrating with: * Google Workspace, and * HRIS or Okta {% endhint %} ### Identity card The identity card gives high-level context for the actor who triggered the event, enabling you to assess how risky the event is. Click the actor's email to open the identity card:\ ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FFK3HVtj5d2oZlpEHmfRR%2Factor%20identity.png?alt=media\&token=6216ee07-0f8a-4cb7-b078-5c89fcb2f590)
Identity card elementDescription
Watchlist indicator Indicates if the actor is being monitored in the Identities watchlist
Risk scorePotential risk the user poses to the organization in terms of data loss or exfiltration
Exposure levelBreakdown of the user's attack surface according to the number of Google and Slack assets the user shared: Internal, external, public
DLP exposureNumber of exposed Google and Slack assets with highly sensitive names.
VIPAn indication whether this user is a VIP, with the specific VIP role, such as such as a director, Vice President, or head of department
Admin rolesNumber of integrated SaaS apps for which the user is an admin
Latest alertsNumber of all active or archived alerts triggered by this user in the last 30 days
View identityOpens the actor's Risk tab in the Identities module
Copy user IDCopy the unique identifier for this actor
### Human vs non-human actors DoControl distinguishes between human users and non-human identities. For each event, DoControl indicates if an application or service account acted on behalf of a user. This actor attribution (human vs non-human) enables you to: * Distinguish normal from anomalous behavior * Significantly reduce false positives for suspicious events * Display all remediation actions that were [performed by DoControl](/docontrol-user-guide/saas-data-monitoring/events/filtering-events.md#filter-remediation-events-performed-by-docontrol) {% hint style="success" %} Actor attribution is currently supported for all Google events, such as downloads, URL access, and sharing removal. {% endhint %} **To investigate events that were performed on behalf of an actor:** 1. Hover over the **Info** icon to discover which app or account service executed the event.
2. Click the **Info** icon to view detailed application metadata.\ ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FbpNXUZ5gOjRSxEWU3GKJ%2Fon%20behalf%20of%20popup.png?alt=media\&token=df5771e0-6e1a-475e-a8f7-800f9d8636aa) 3. Copy the **App ID** and **Installation ID** for further investigation. ## Event-based workflows A customer can build any security workflow that's based on a specific event, from notifying on suspicious behavior, to remediating risk in real time. When you create an [event-based workflow](/docontrol-user-guide/workflows/create-a-workflow.md#event-based-workflow), it's triggered by a single event in a specific SaaS app.
## Triggered entities Triggered entities include workflows and alerts that were triggered by a specific event. You can drill down into specific workflows or alerts and learn more about the risk. Each triggered workflow or alert is displayed with: * Name of workflow or alert * Date and time the workflow or alert was triggered * Alerts only: Severity level (high, medium, low)

Workflows and alerts that were triggered by an event

#### To view more information for triggered workflows or alerts: 1. For **alerts**: click **View** ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FBiUsllxLPUlA0iahPa7p%2Fpreview%20icon.png?alt=media\&token=c70204c2-239e-4a75-9b43-d6106c30488b) to open the specific alert. 2. For **workflows**: Click the **More** ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FgRWgKsPpr1P3kYK5t6s9%2Fellipsis.png?alt=media\&token=9a356ebe-c05f-46c0-8cec-0c2cd7c1ea50) button next to the relevant workflow.\ \ ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2Frjr2iwZA8XCQCHg32vja%2Ftriggered%20WF%20options.png?alt=media\&token=4021504b-1cab-440d-84aa-75d2e3e2cc3a)
3. Click **View execution** to display the execution details, including input, output and the trigger event. 4. Click **Edit workflow** to open the workflow canvas for editing. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/events.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.