Best practices for handling alerts | Docusign

Docusign Monitor includes pre-built alerts for common types of suspicious activity, and enables you to create custom alerts using the Monitor API. Because alerts can be triggered by malicious or authorized activity, we provide several options so you can appropriately respond to potential threats as they are investigated and resolved.

Sample alert types:

User fails six or more login attempts in an hour
Admin disables a user-authentication requirement
Admin initiates a bulk user export
User downloads 20 or more envelopes in an hour
User logs in from a location more than 100 km from any previous location

Corrective actions

When an administrator or security operations team receives an alert from Monitor, they should act quickly to investigate the alert and respond appropriately. For example, if a user fails too many consecutive login attempts, an administrator could reset that user’s password—or take one of the following actions:

Close a user’s membership

If an account has been flagged as compromised, you can close that account to prevent additional activity while you investigate.

Required privileges: Docusign Administrator, or eSignature Administrator on the same organization account as the user.

To close the account:

Select Users in the main menu.
Select the user from the display.
From the Actions menu, select Close.

For more information, see Manage eSignature users.

Revoke the user’s administrator privileges

If a delegated admin account is flagged as compromised because of suspicious activity, you can revoke admin privileges while you investigate.

Required privileges: Docusign Administrator

To revoke the user’s admin privileges:

From the Docusign Admin dashboard, click Administrators.
Locate the administrator you want to remove.
From the Actions menu, select Remove.
Choose Confirm.

Alternatively, you can change the user profile as described in the User Details section in User Management.

Force a password reset

If an account shows signs of suspicious activity, you can notify the account owner and force a password reset to help prevent unauthorized access.

Required privileges: eSignature Administrator on the user’s account

To force a password reset:

Select Users in the main menu.
Select the user from the display.
From the Actions menu, select Reset Password.

For more information, see the Reset User Password section in Manage Users.

Transfer a user’s envelopes and templates

If a user account has been compromised, you can transfer their envelopes and templates to a secure user account.

Required privileges: eSignature Administrator on the user’s account

To transfer a user’s envelopes and templates:

Select Users in the main menu.
Select the user from the display.
From the Actions menu, select Transfer Envelopes or Transfer Templates.

For more information, see the Transfer envelopes or templates between users section in Transfer Envelopes or Templates.

Revoke the user’s eSignature administrator privileges

If an eSignature admin account is flagged as compromised because of suspicious activity, you can revoke eSignature admin privileges while you investigate.

Required privileges: Docusign Administrator

To revoke a user’s eSignature administrator privileges:

From the Docusign Admin dashboard:

Select Users and search for the user by email address. The user’s profile appears.
In the Actions tab, select Edit.
In the Enable Applications section, in eSignature select a new permission profile for the user.

From the Monitor Alert History page:

When the Alert History panel is opened for a particular alert, choose Manage User. The user’s profile appears.
In the Actions tab, select Edit.
In the Enable Applications section, in eSignature select a new permission profile for the user.

For more information see the View and manage details for a user section in User Management.

Restore the user’s envelopes

If envelopes were transferred from a potentially compromised account, and that account has been cleared after an investigation, those envelopes can be restored to the original user.

Required privileges: eSignature account administrator

To restore a user’s envelopes:

Select Docusign eSignature Agreements tab in the main menu.
In the Envelopes section, select Deleted.
Select the deleted envelopes and then move them to the desired folder.

Next steps

Review the Event and Alert objects in the API reference
See the list of tracked alerts