> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coveapp.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# Staff watch

> Notices when a staff member acts far outside normal, and can step in before it spreads.

Most damage to a Discord server is done by somebody who was given permissions
legitimately. The staff watch exists for that: it notices when a member of your
team does something far outside normal, and can act before the rest happens.

<Frame caption="What the staff watch has seen.">
  <img src="https://cdn.coveapp.cc/docs/images/moderation/staff-watch.png" alt="Moderation → Staff watch" />
</Frame>

## What it watches

Cove reads your server's audit log, not its messages. It knows a channel was
deleted; it has no idea what was said in it.

| Signal           | Flags                               |
| ---------------- | ----------------------------------- |
| Bans             | A burst of bans in a short window   |
| Kicks            | A burst of kicks                    |
| Timeouts         | A burst of timeouts being set       |
| Channels deleted | Channels being removed quickly      |
| Roles deleted    | Roles being removed quickly         |
| Role changes     | Permissions being edited repeatedly |
| Webhooks made    | Webhooks created in bulk            |

Each signal has a threshold over a rolling window — a burst, not a total. One
ban is Tuesday; six bans in two minutes is not.

## The two modes

| Mode          | What it does                                                   |
| ------------- | -------------------------------------------------------------- |
| Watch only    | Records what it sees, and changes nothing. The default         |
| Watch and act | Also removes the roles letting them continue, and opens a case |

Start on watch only. Give it a week against your server's real rhythm, look at
what it flagged, then decide whether the thresholds match how your team
actually works.

## When it gets it wrong

It will, eventually — somebody doing a legitimate mass cleanup looks exactly
like somebody doing damage. That is why acting always opens a case, and a case
can be [reverted](/moderation/cases): the roles go back, and the history keeps
a record that it happened and was undone.

<Warning>
  The bot needs **View Audit Log** in your Discord server. Without it the watch
  has nothing to read and sits empty — if you invited Cove before this existed,
  you may need to re-authorise it.
</Warning>

## Permissions

| Permission                 | What it allows                         |
| -------------------------- | -------------------------------------- |
| Change moderation settings | Turn the watch on, and choose its mode |
| Revert cases               | Undo a case the watch opened           |