The Universal Anomaly Event provides a standardized way to identify and categorize anomaly threat detection events across multiple domains.
Where: This change applies to Lightning Experience in Enterprise, Performance, Unlimited, and Developer editions.
Who: This change is available to users with the Event Monitoring or Salesforce Shield license.
Why: This event acts as a unifying anomaly classification layer. Use the subtype field to identify anomaly types available via Shield Event Monitoring.
The Universal Anomaly Event does not currently include detailed anomaly payloads or detection-specific metrics. Use the Universal Anomaly Event to understand which threat detection events are triggered while using reports and dashboards to analyze threat detection patterns.