Detecting and Responding to Suspicious Access
What to do when you receive a suspicious login alert or find unfamiliar activity in your WorkVell account.
[Suspicious access alerts]
Notifications are triggered by:
- Login from an unusual country or region
- Login from an unrecognized new device
- Multiple failed login attempts in quick succession
[Check steps]
(1) Review your recent login history
My Page → Security → Login History
Check date, IP address, device, and location
(2) Admin audit log
Admin Settings → Security → Audit Log (see #SEC-003)
[Emergency response if unauthorized access is suspected]
- 1.Change password immediately
- 2.Log out all sessions
My Page → Security → Log Out of All Devices
- 3.Set up MFA if not already done (see #GEN-046)
- 4.Report to admin for investigation
[Admin response]
- Suspend the account:
Admin Settings → User Management → Select user → Suspend Account
- Identify scope of unauthorized access via audit log
- Identify affected data and notify relevant parties
⚠ Unauthorized account access is a security incident. Follow your company's security policy and consult external specialists if needed.
detectingrespondingsuspiciousreceiveloginalert
Was this article helpful?