Dropbox security alerts

With security alerts, admins receive email notifications whenever suspicious behavior, risky activity, or potential data leaks are detected. These alerts help admins investigate issues and take action to help protect their team and data.

View alert details

You can view details about a specific alert, including who is responsible, what happened, when it happened, and what files, folders, or people were impacted.

To open alert details from an email notification, click Open alert.

To view alert details on dropbox.com:

1. Log in to dropbox.com with your admin credentials.
2. Click Admin console in the left sidebar.
3. Under Products, click the dropdown next to Dropbox.
4. Click Security.
5. Click Security alerts.
6. Click ☑ (more options) next to the alert you’d like to view.
7. Click Open alert details.

Take action on an alert

From the alert details page, you’ll be provided different options based on the alert types. These include:

• Restore in activity page. If you were sent a Mass deletion alert, this will take you to the activity page where you can restore the deleted files.
• Email team member. Email the team member who triggered the alert.
• Suspend team member. Suspend the team member responsible for the alert.
• Acknowledge. Mark the alert as acknowledged and remove it from the main alerts list.
• In Progress. Mark the alert as in progress and remove it from the main alerts list.
• Resolved. Mark the alert as resolved and remove it from the main alerts list.
• Dismissed. Mark the alert as dismissed and remove it from the main alerts list.

Exclude a malware file from future alerts

After Dropbox detects a file as malware, you can mark it as excluded to prevent future malware alerts for that file.

To exclude a malware file:

1. Log in to dropbox.com with your admin credentials.
2. Click Admin console in the left sidebar.
3. Under Products, click the dropdown next to Dropbox.
4. Click Security.
5. Click Security alerts.
6. Click ☑ (more options) next to the malware alert.
7. Click Open alert details.
8. Toggle Receive alerts for this file to No.
   • Note: To receive alerts for this file again, toggle Receive alerts for this file to Yes. If the file appears in Excluded files, click Remove.

The file won’t trigger future malware detections unless it’s detected as a different file.

What kinds of events trigger an alert?

Security alerts are generated for the following events:

• Ransomware detection. Detect suspicious activity early and help prevent suspected malicious ransomware attacks from spreading.
• Mass deletion. A team member deleted an unusually large amount of data over a short period of time.
• Mass data move. A team member moved an unusually large amount of data over a short period of time.
• Sensitive content in team folders shared externally. A file in a team folder that contains personal information was shared outside your team. Or, personal information was detected in an already externally shared file.

• Malware shared from outside your team. Someone outside your team shared a malware file with team members.
• Malware shared with your team. A team member shared a file containing malware.
• Too many login attempts. A team member tried to log in unsuccessfully too many times.
• Login from a high-risk country. A team member logged in from a location that could be considered high-risk. This includes logins from the following countries: Afghanistan, China, Cuba, Democratic People's Republic of Korea, Islamic Republic of Iran, Libya, Nigeria, Sudan, Syrian Arab Republic, and Yemen.

Set alert sensitivity

If you’re getting too many alerts, you can change the sensitivity of Mass deletion and Mass move alerts. To change alert sensitivity:

1. Log in to dropbox.com with your admin credentials.
2. Click Admin console in the left sidebar.
3. Under Products, click the dropdown next to Dropbox.
4. Click Security.
5. Click Security alerts.
6. Click ☑ (more options) next to the alert you’d like to change.
7. Next to Alert sensitivity, select a sensitivity level.
8. Click Save.

Manage alert notifications

To change who receives notifications about a type of alert:

1. Log in to dropbox.com with your admin credentials.
2. Click Admin console in the left sidebar.
3. Under Products, click the dropdown next to Dropbox.
4. Click Security.
5. Click Security alerts.
6. Click ☑ (more options) next to the alert you’d like to change.
7. Click Manage this policy.
8. Next to Notifications, select either All team admins or Specific team admins / security admins / groups.
9. Click Save.

Turn alerts off or on

By default, all alert types are turned on. To turn alerts off or on:

1. Log in to dropbox.com with your admin credentials.
2. Click Admin console in the left sidebar.
3. Under Products, click the dropdown next to Dropbox.
4. Click Security.
5. Click Security alerts.
6. Click ☑ (more options) next to the alert type you’d like to turn on or off.
7. Click Manage this policy.
8. Next to General information, toggle the alert on or off.
9. Click Save.