Docusign Monitor includes pre-built alerts for common types of suspicious activity, and enables you to create custom alerts using the Monitor API. Because alerts can be triggered by malicious or authorized activity, we provide several options so you can appropriately respond to potential threats as they are investigated and resolved.
Sample alert types:
When an administrator or security operations team receives an alert from Monitor, they should act quickly to investigate the alert and respond appropriately. For example, if a user fails too many consecutive login attempts, an administrator could reset that user’s password—or take one of the following actions:
If an account has been flagged as compromised, you can close that account to prevent additional activity while you investigate.
Required privileges: Docusign Administrator, or eSignature Administrator on the same organization account as the user.
To close the account:
For more information, see Manage eSignature users.
If a delegated admin account is flagged as compromised because of suspicious activity, you can revoke admin privileges while you investigate.
Required privileges: Docusign Administrator
To revoke the user's admin privileges:
Alternatively, you can change the user profile as described in the User Details section in User Management.
If an account shows signs of suspicious activity, you can notify the account owner and force a password reset to help prevent unauthorized access.
Required privileges: eSignature Administrator on the user's account
To force a password reset:
For more information, see the Reset User Password section in Manage Users.
If a user account has been compromised, you can transfer their envelopes and templates to a secure user account.
Required privileges: eSignature Administrator on the user's account
To transfer a user's envelopes and templates:
For more information, see the Transfer envelopes or templates between users section in Transfer Envelopes or Templates.
If an eSignature admin account is flagged as compromised because of suspicious activity, you can revoke eSignature admin privileges while you investigate.
Required privileges: Docusign Administrator
To revoke a user's eSignature administrator privileges:
For more information see the View and manage details for a user section in User Management.
If envelopes were transferred from a potentially compromised account, and that account has been cleared after an investigation, those envelopes can be restored to the original user.
Required privileges: eSignature account administrator
To restore a user's envelopes: