This detection rule monitors critical activities regarding template management in DocuSign, specifically focusing on the creation, modification, and deletion of templates. Since templates serve as foundational elements for many document workflows, unauthorized changes can lead to significant disruptions in business processes and data integrity. The rule captures events such as 'template-created', 'template-modified', and 'template-deleted', providing necessary data for auditing and compliance purposes. The associated runbook provides a step-by-step guide for the incident response team to validate and investigate these events thoroughly, ensuring that all changes align with established approval processes and user permissions. This monitoring is essential, as deletions may indicate malicious intent or negligence, making timely detection vital for maintaining operational security.