---
schema_version: "1"
id: ca05c63b5af50b83191aea8fe9717f93f1f420cbc3bdbc19ac1d19c6bba20a7e
title: Security | Identify Anomalies
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/ai/264-0-0/agent_ref_identify_anomalies.md
canonical_url: https://help.salesforce.com/s/articleView?id=ai.agent_ref_identify_anomalies.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 919236a2e3ab802a064de86c5b879038ced105d05d9e52e822f3aacdb8ba00b6
description: Analyzes security alerts and metrics to identify anomalies and potential threats for each tenant and metric type.
products:
  - Agentforce
  - Cross Cloud
release: "264"
---
# Security | Identify Anomalies

Analyzes security alerts and metrics to identify anomalies and potential threats for each tenant and metric type.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions with the Security Center add-on and Foundations or <strong>Agentforce 1</strong> Editions.</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d70338e75">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d70338e75 ">To view Security Center pages:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d70338e75 ">View Security Center</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d70338e75 ">To create and edit security policies:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d70338e75 ">Manage Security Center</td>

          </tr>
          <tr class="">
            <td class="slds-cell-wrap" colspan="2" style="vertical-align:top;" headers="d70338e75 ">See <a href="https://help.salesforce.com/s/articleView?id=ai.agent_actions_common_perms.htm&amp;type=5&amp;language=en_US" target="_blank">Common User Access for Standard Agent
                Actions</a>.</td>

          </tr>
        </tbody>
      </table>

## Action Details

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small "><colgroup><col style="width:50%"> <col style="width:50%"></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">API Name</td><td class="slds-cell-wrap" style="vertical-align:top;">IdentifyAnomalies</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Reference Action Type</td><td class="slds-cell-wrap" style="vertical-align:top;">Standard Action</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Does this tool run one or more prompt templates?</td><td class="slds-cell-wrap" style="vertical-align:top;">Yes</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Required setup</td><td class="slds-cell-wrap" style="vertical-align:top;">Turn on Security Center and Security Agent with View Security Center or Manage Security Center user permission.</td></tr></tbody></table>

## IdentifyAnomalies and Prompt Templates

The tool runs the Identify Anomalies prompt template. The prompt template acts as a security analyst:

- Identifies unusual patterns, including unexpected login behaviors, data access spikes, and privilege escalations.
- Correlates data across multiple sources to detect security anomalies.
- Filters false positives to ensure accurate threat detection.
- Provides structured output that includes severity levels, risk assessments, and recommended remediation actions.

## Guidelines and Considerations

`IdentifyAnomalies` analyzes multiple data sources, including security alerts, metrics, and threat detection events.

- Categorizes anomalies by High, Medium, or Low severity with specific details and risk assessments.
- Focuses on genuine security concerns rather than routine events.
- Includes specific user information and recommended remediation steps in the results.
- Returns a clear "No Security Anomalies Detected" message when the system detects no anomalies.