> You are reading the Docusign Developer Documentation. For clean Markdown of any page, append .md to the page URL.
>
> Documentation indexes by section:
> - APIs and SDKs: https://docusign.docs.buildwithfern.com/docs/llms.txt
> - Platform 101: https://docusign.docs.buildwithfern.com/platform/llms.txt
> - Extension Apps: https://docusign.docs.buildwithfern.com/extension-apps/llms.txt
> - Docusign CLI: https://docusign.docs.buildwithfern.com/docusign-cli/llms.txt
>
> Authentication (OAuth, JWT Grant, M2M): https://docusign.docs.buildwithfern.com/platform/auth
> Webhooks and Connect: https://docusign.docs.buildwithfern.com/platform/webhooks
>
> OpenAPI specifications: https://docusign.docs.buildwithfern.com/openapi.json
> MCP server: https://docusign.docs.buildwithfern.com/_mcp/server

# Best practices for handling alerts

Docusign Monitor includes pre-built alerts for common types of suspicious activity, and enables you to create custom alerts using the Monitor API. Because alerts can be triggered by malicious or authorized activity, we provide several options so you can appropriately respond to potential threats as they are investigated and resolved.

Sample alert types:

* User fails six or more login attempts in an hour
* Admin disables a user-authentication requirement
* Admin initiates a bulk user export
* User downloads 20 or more envelopes in an hour
* User logs in from a location more than 100 km from any previous location

## Corrective actions

When an administrator or security operations team receives an alert from Monitor, they should act quickly to investigate the alert and respond appropriately. For example, if a user fails too many consecutive login attempts, an administrator could reset that user’s password—or take one of the following actions:

### Close a user's membership

If an account has been flagged as compromised, you can close that account to prevent additional activity while you investigate.

**Required privileges:** Docusign Administrator, or eSignature Administrator on the same organization account as the user.

To close the account:

1. Select **Users** in the main menu.

2. Select the user from the display.

3. From the **Actions** menu, select **Close**.

For more information, see [Manage eSignature users](https://support.docusign.com/s/document-item?language=en_US\&rsc_301\&bundleId=pik1583277475390\&topicId=ixb1583277365937.html&_LANG=enus).

### Revoke the user's administrator privileges

If a delegated admin account is flagged as compromised because of suspicious activity, you can revoke admin privileges while you investigate.

**Required privileges:** Docusign Administrator

To revoke the user's admin privileges:

1. From the **Docusign Admin** dashboard, click **Administrators**.

2. Locate the administrator you want to remove.

3. From the **Actions** menu, select **Remove**.

4. Choose **Confirm**.

Alternatively, you can change the user profile as described in the User Details section in [User Management](https://support.docusign.com/s/document-item?language=en_US\&rsc_301\&bundleId=rrf1583359212854\&topicId=jni1583359185567.html&_LANG=enus).

### Force a password reset

If an account shows signs of suspicious activity, you can notify the account owner and force a password reset to help prevent unauthorized access.

**Required privileges:** eSignature Administrator on the user's account

To force a password reset:

1. Select **Users** in the main menu.

2. Select the user from the display.

3. From the **Actions** menu, select **Reset Password**.

For more information, see the Reset User Password section in [Manage Users](https://support.docusign.com/s/document-item?language=en_US\&rsc_301\&bundleId=rrf1583359212854\&topicId=jni1583359185567.html&_LANG=enus).

### Transfer a user's envelopes and templates

If a user account has been compromised, you can transfer their envelopes and templates to a secure user account.

**Required privileges:** eSignature Administrator on the user's account

To transfer a user's envelopes and templates:

1. Select **Users** in the main menu.

2. Select the user from the display.

3. From the **Actions** menu, select **Transfer Envelopes** or **Transfer Templates**.

For more information, see the Transfer envelopes or templates between users section in [Transfer Envelopes or Templates](https://support.docusign.com/s/document-item?language=en_US\&rsc_301\&bundleId=pik1583277475390\&topicId=vyz1583277376194.html&_LANG=enus).

### Revoke the user's eSignature administrator privileges

If an eSignature admin account is flagged as compromised because of suspicious activity, you can revoke eSignature admin privileges while you investigate.

**Required privileges:** Docusign Administrator

To revoke a user's eSignature administrator privileges:

* From the **Docusign Admin dashboard**:

1. Select **Users** and search for the user by email address. The user’s profile appears.

2. In the **Actions** tab, select **Edit**.

3. In the **Enable Applications** section, in eSignature select a new permission profile for the user.

* From the **Monitor Alert History** page:

1. When the **Alert History** panel is opened for a particular alert, choose **Manage User**. The user’s profile appears.

2. In the **Actions** tab, select **Edit**.

3. In the **Enable Applications** section, in eSignature select a new permission profile for the user.

For more information see the View and manage details for a user section in [User Management](https://support.docusign.com/s/document-item?language=en_US\&rsc_301\&bundleId=rrf1583359212854\&topicId=jni1583359185567.html&_LANG=enus).

### Restore the user's envelopes

If envelopes were transferred from a potentially compromised account, and that account has been cleared after an investigation, those envelopes can be restored to the original user.

**Required privileges:** eSignature account administrator

To restore a user's envelopes:

1. Select **Docusign eSignature Agreements** tab in the main menu.
2. In the **Envelopes** section, select **Deleted**.
3. Select the deleted envelopes and then move them to the desired folder.

## Next steps

* Review the Event and Alert objects in the [API reference](/docs/monitor-api/reference)
* See the [list of tracked alerts](/docs/monitor-api/monitor101/events-alerts#list-of-tracked-events)