Here are some potential use cases that Docusign Monitor tracks and notifies you about:

• An administrator removes a security policy from any user (such as the policy to enforce SSO login)
  • Potential threat: Unauthorized access and data loss
  • Action: Contact Docusign the administrator to verify the activity was intentional and warranted
     
• A user logs in from a location from which they haven’t logged on from in the last 90 days
  • Potential threat: Malicious outside hacker
  • Action: Notify user, force log off, change password

• A user tries to access or delete more than 50 envelopes in a day
  • Potential threat: Unauthorized access or data loss
  • Action: Contact the administrator to verify the activity was intentional and warranted

• Docusign REST API activity increases suddenly
  • Potential threat: Compromised credentials leading to an unauthorized flow of data
  • Action: Contact the administrator to verify the activity was intentional and warranted

Thanks for posting your question on the Docusign Community!