> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/events/filtering-events.md). # Filter events \ DoControl's Events page is a powerful investigation surface that gives you instant context and precision filtering. You can filter all the real-time events that DoControl monitors, including [risky events](#risky-events) that might cause data exposure or exfiltration. By default, the Events page shows the most recent events from the **same** **day**.

{% hint style="info" %} * If no date range is selected, events are displayed from the last **24 hours**. * You can search for events that occurred during the last 6 months. {% endhint %} You can filter your events with any combination of these filters: * [Quick filters](#quick-filters) * [Date and time filter](#date-and-time-filter) * [App filter](#app-filter) * [Actor filter](#actor-filter) * [Target filter](#target-filter) * [Advanced event filters](#advanced-event-filters) * [Advanced identity filters](#advanced-identity-filters) {% hint style="success" %} * To download all filtered events, click the

**Export to CSV** icon. You can download up to 50,000 events at a time. * See DoControl's [use cases for advanced filtering](#use-cases-for-advanced-filtering) {% endhint %} ## Quick filters You can filter events according to these quick filters. All events are considered risky since they might cause data exposure or exfiltration. Events are displayed from the last 7 days:

Quick event filter	Description
Downloads by risky users	Events involving a file that was saved from the app to a risky actor's operating environment The user who downloaded has a risk score between 80-100
Downloads by watchlist users	Events involving a file that was saved from the app to a watchlist actor's operating environment The user who downloaded was added to DoControl's Identities watchlist
External shares by watchlist users	Events that involve assets having being shared with external collaborators outside your organization The actor who shared was added to DoControl's Identities watchlist
Public/external shares by admins	Events that involve assets being shared with external collaborators outside your organization, or via public links or web publishing The actor who shared has at least one admin role
Public/external shares by risky users	Events that involve assets being shared with external collaborators outside your organization, or via public links or web publishing The user who shared has a risk score between 80-100
Public shares by non-admins	Events that involve assets being shared via public links or web publishing The user who shared does not have any admin roles
Terminated users with risky events	Events that might cause data exposure or exfiltration, including external and public shares, upload/download, and user operations, such as login from a non-trusted IP Terminated users are users whose employment with the company has ended

#### To filter events with quick filters: 1. From the DoControl side menu, click **Events**. 2. Select a quick filter to display event types from the last 7 days:\ \ ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FqSZiKgvLa9LAJUXLf6tw%2FEvent%20quick%20filters.png?alt=media\&token=582cb6ff-2a4d-4c0e-9dfd-df9c03c76f23) For example: If you select **Downloads by watchlist users,** all assets that were downloaded by users on your watchlist are displayed:

## Date and time filter You can filter for events from a predefined date range or a custom range from the last 6 months. {% hint style="info" %} * To search for events older than 6 months, contact Customer Success. * Up to 3 custom date ranges are displayed in the date filter. {% endhint %} #### To filter for events from a predefined date range: 1. Click the date filter.\ \ ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2Fy0tuED83XxRPlGhKGiFm%2Fcustom%20date%20range.png?alt=media\&token=2090261e-eb3d-412c-b6ee-4c5419ea6ac6) 2. Select the relevant range: * Last 24 hours * Last 7 days * Last 14 days * Last 31 days #### To filter events from a custom date range: 1. Click the date filter. 2. Click **Custom range**. 3. Click a **specific** date to filter events for any calendar day in the last 6 months. 4. Select a **start** **date and time** and **end date and time** to filter events for any range in the last 6 months.

5. Click **Save and close**.\ Up to 3 custom date ranges are displayed in the date filter. {% hint style="info" %} If you define more than 3 custom date ranges, the previous ranges are overwritten in the date dropdown menu. {% endhint %} ## App filter Include or exclude any integrated SaaS app that was involved in the event: * Box * CrowdStrike * Dropbox * Entra ID * GitHub * Google Drive * Google Workspace * Okta * OneDrive * Salesforce * SharePoint * Slack or Slack Enterprise * Teams * Zoom

## Actor filter Filter for the user who triggered the event using any of these operators:

Operator	Description
Equals	An exact match for the actor's email
Doesn't equal	Actor's email doesn't have the exact match
Starts with	Actor email begins with the entered string
Ends with	Actor email ends with the entered string
Contains	Actor email has the partial string
Doesn't contain	Actor email doesn't have the partial string
Includes	Events triggered by any of several actor emails
Excludes	Events not triggered by any of several actor emails

## Target filter Filter for the recipient of the event using any of these operators:

Operator	Description
Equals	An exact match for the recipient's email
Doesn't equal	Recipient's email doesn't have the exact match
Starts with	Recipient email begins with the entered string
Ends with	Recipient email ends with the entered string
Contains	Recipient email has the partial string
Doesn't contain	Recipient email doesn't have the partial string

## Advanced event filters Use advanced filters for pinpointed filtering of specific events. With DoControl's advanced event filters, you get comprehensive context and precision filtering. {% hint style="success" %} You can add as many filters as necessary. {% endhint %}

Advanced event filter	Operator	Description
Access event	Includes/ excludes	Include or exclude these event types: Access Login
Actor type	Equals	Who performed the event: Non-human - App or service account Human - Real-person user
App ID	Equals/ doesn't equal Starts with / ends with Contains/ doesn't contain Includes/ excludes	Unique identifier for the application where the event was triggered
Asset	Equals/ doesn't equal Starts with / ends with Contains/ doesn't contain	If the string appears in the asset title involved in the event
Event ID	Equals/ doesn't equal Starts with / ends with Contains/ doesn't contain Includes/ excludes	If the string appears in the unique event identifier
Event type	Includes/ excludes	User action as defined in the relevant SaaS app, for example: Identity risk score changed (DoControl)
IP address	Equals/ doesn't equal Starts with / ends with Contains/ doesn't contain	Filter for suspicious activity according to an IP address IPv4 and IPv6 are supported, but not CIDR format
Location	Includes/ excludes	City and country where event occurred
Risk category	Includes/ excludes	Type of risky event: External share Public share Upload/download User operations
Triggered	Includes/ excludes	Events that triggered these entities: Workflows Alerts
Triggered alert ID	Equals/ doesn't equal Starts with / ends with Contains/ doesn't contain	Events that triggered alerts with this unique alert identifier

## Advanced identity filters Use advanced identity filters for pinpointed filtering of specific events, to help you understand who actually performed an action and who is involved. With DoControl's advanced identity filters, you can surface events with a rich identity context whenever the actor or target email matches a known monitored identity. {% hint style="success" %} You can add as many filters as necessary {% endhint %}

Advanced Identity filter	Operator	Description
Admin	Equals	If the user who triggered the event is an admin user: True False
Employment status	Includes/ excludes	The current employment status of the internal user who triggered the event: Active Terminated About to leave
Employment type	Equals/ doesn't equal Starts with / ends with Contains/ doesn't contain Includes/ excludes	The employment type (as updated in Okta or HRIS) of the user who triggered the event: Full-time/ advisor Part-time/ Intern/ Hourly Contractor/ Outsourcer/ Contingent/ Temporary/ Freelancer
Has identity	Equals	Users with an identity profile who triggered events Apps acting on behalf of users are also displayed
Identity name	Equals/ doesn't equal Starts with / ends with Contains/ doesn't contain	Displays all events triggered by user identities with this name
Job title	Equals/ doesn't equal Starts with / ends with Contains/ doesn't contain	Displays all events triggered by user identities with this job title
Last activity	Equals After Before Is between	Displays the last event(s) triggered by a user or an app acting in a user’s name
Risk score	is between	Displays all events for users in a specific risk bracket: 80-100 (critical) 50-79 (high) 30-49 (medium) 0-29 (low)
VIP	Equals	Displays all events triggered by a VIP user, such as a director, Vice President, or head of department True False
Watchlist	Equals	Displays all events triggered by a watchlist user (added to the Identities watchlist): True False

## Use cases for advanced filtering With DoControl's advanced filtering capabilities, you can address a wide range of use cases when filtering events: ### Filter events triggered by a non-human You can display all events that were triggered by an app or service account on behalf of a user. These events are considered to be less risky, unless they were executed by a shadow app. 1. In the **Events** page, select **More filters**. 2. Select **Actor type** equals **Non-human**.

3. All events triggered by non-human users are displayed:

4. Click the **Info**

icon to display more details about the non-human user:\ \ ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FpCNfBdALJ8hMoIYOvEEa%2Fon%20behalf%20of%20popup.png?alt=media\&token=1dfb8f50-a88a-470c-a1d3-ca7062b96774) 5. Copy the **App ID** to investigate further. 6. Copy the **Installation ID** to investigate further. ### Filter remediation events performed by DoControl You can display all remediation events that were performed by the DoControl app on behalf of a user. 1. In the **Events** page, select **More filters**. 2. Select **Actor type** equals **Non-human**. 3. For the **Event type**, select the relevant application where the remediation event occurred, such as **Google Drive > Change user access.**

All remediation events that were performed by DoControl on behalf of a user are displayed:

### Filter events in a specific location To investigate risk, you can filter for all events that occurred in a specific location. 1. In the **Events** page, select **More filters**. 2. Select **Location** includes **\[city, country]**.

3. All events that occurred in that location are displayed. ## Risky events Risky events in your integrated SaaS apps might cause data exposure or exfiltration. You can investigate any risky behavior by filtering for risky events according to category: * **External share** - Assets shared with external collaborators via sharing permissions * **Public share** - Assets made accessible to anyone via a link or web publishing * **Upload/download** - Assets uploaded to or downloaded from your organization * **User operations** - User activity that poses an IT or security risk, such as login from a non-trusted IP or disabling MFA #### To filter for risky events: 1. In the Events page, click **Filters**.

2. Under **More filters**, select **Risk category** and choose the relevant type: * External share * Public share * Upload/download * User operations 3. Add any other relevant filters. 4. Click **Apply**.

After filtering for the Public share risk category, all events involving assets that were publicly shared are displayed

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/events/filtering-events.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.