> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/events/docontrol-events.md).
# DoControl events
DoControl generates its own events that you can leverage in workflows:
* [Identity risk score changed](#identity-risk-score-changed)
* [Security check status changed](#security-check-status-changed)
## Identity risk score changed
It can be difficult to understand how, when, and why a user's risk score changed. DoControl gives you full visibility into risk score changes, and notifies you immediately whenever a user's risk score changes.
The `Identity risk score changed` event is triggered whenever a user's risk score increases or decreases, even by 1 point. The event is enriched with data, and includes breakdowns of old and new risk scores, allowing you to better understand the reasons for risk spikes.
This event type can be leveraged in 2 ways:
* [Investigate risk changes](#investigate-risk-changes) - From the Events page, you can investigate changes in a user's risk score. See the full context for the risk change in a JSON file and leverage it in investigations.
* [Create workflows triggered by identity risk score change ](#create-workflows-triggered-by-identity-risk-score-change)- You can define workflows to track risk changes, and automatically notify your security team whenever a user's risk score changes significantly.
### Investigate risk changes
DoControl generates an event every time a user's risk score changes, even by 1 point. From the JSON files in the Events page, you can investigate the reasons for changes in a user's risk score:
1. In DoControl, go to **Events**.
2. Under **Filters**, select `Event type includes Identity risk score changed`.
3. For each internal user where the risk score changed, you can compare the old score to the new score. For example:\
`Old score: 48, New score: 99`
4. Click the **JSON** link to see the full data context for risk change and leverage it in your investigations.
Investigate the JSON file for any Identity risk score changed event
5. Click the **actor** name to open the Identities risk card for that user.
#### Data-rich event context
From the Events page, you can investigate changes in a user's risk score. Each **Identity risk score changed** event is displayed with its full context in a [JSON file](#json-example), and includes these parameters:
Identity context
Parameters
User identity
Identity name
Identity’s department
Job title
SaaS app roles
Employment status
Employment type
Emails (personal and work)
Old risk
User's previous risk score with breakdown of risk elements
Department or organization’s previous risk score with breakdown of risk elements
New risk
User's current risk score with breakdown of risk elements
Department or organization’s current risk score with breakdown of risk elements
Workflows triggered by a change in identity risk score
{% hint style="success" %}
For pre-populated risk identity management playbooks, see [Monitor risk change](/docontrol-user-guide/risk-management/identities/monitor-risk-change.md).
{% endhint %}
#### To create a workflow to monitor identity risk score changes:
1. In Workflows, select **New workflow.**
2. For the app, select **DoControl**.
3. For the trigger, select **Event > Identity risk score changed.**
4. Add a **Conditional** action.
5. Define the condition, for example: If the \ - \ is greater than 30.
* If **true** - Notify the security team via email or Slack.
* If **false** - End the workflow.
6. Customize the **Notify by email** action:\
` risk score increased significantly from to due to . Please investigate.`
## Security check status changed
DoControl gives you full visibility into newly detected misconfigurations, and notifies you immediately whenever a security check fails.
The `Security check status changed` event is triggered whenever a security check changes its status. The event is enriched with data, and includes breakdowns of old and new security check results, allowing you to better understand the reasons for a misconfiguration.
This event type can be leveraged in 2 ways:
* [Investigate security check changes ](#investigate-security-check-changes)- From the Events page, you can investigate changes in a security check scan result. See the full context for the status change in a JSON file and leverage it in investigations.
* [Create workflows triggered by security check status change](#create-workflows-triggered-by-security-check-status-change) - You can define workflows to track changes in security scan checks, and automatically notify your security team whenever a security check fails.
### Investigate security check changes
DoControl generates an event every time the status of a security check changes. From the JSON files in the Events page, you can investigate the reasons for changes in a security check:
1. In DoControl, go to **Events**.
2. Under **Filters**, select Event type includes **Security check status changed**.
3. For each security check whose status was changed, for example, from Pass to Fail, you can view any workflows or alerts that were triggered as a result.
4. Click the **JSON** link to see the full data context for security check status change, by comparing the previous evaluation with the new evaluation, and leveraging it in your investigations.
### Create workflows triggered by security check status change
You can define a workflow to automatically notify your security team by email or Slack whenever the status of a security check changes, for example, from Pass to Fail. You can leverage workflows to manage misconfigurations automatically:
* Configure your workflow to open a Jira ticket to handle the misconfiguration
* Add a remediation workflow to resolve the misconfiguration
* Forward detected misconfiguration data to your SIEM or any other system using DoControl workflows
These workflows are triggered by DoControl's **Security check status changed** event, and are displayed in the Workflow list under the DoControl app:
Workflows triggered by a change in security check status
**To create a workflow to monitor security check status changes:**
1. In Workflows, select **New workflow.**
2. For the app, select **DoControl**.
3. For the trigger, select **Event > Security check status changed.**
4. Add a **Conditional** action.
5. Define the condition, for example: If the \ equals \:
* If **true** - Notify the security team via email or Slack.
* If **false** - End the workflow.
6. Customize the **Notify by email or Notify in Slack** action, or open a Jira ticket:\
`The security check: recently failed. Please investigate.`
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/events/docontrol-events.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
