---
schema_version: "1"
id: 9a0197d2c16b30dc3eb906fadc05d719e3a6e0d929c152f2cba183c5f852a04d
title: Universal Anomaly Event
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/260-0-0/rn_security_em_universal_anomaly_event.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_em_universal_anomaly_event.htm&release=260&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 093808c365ed107c104bd83f1d2be6f4d3fe2f319f11ecb423ad73c9cb7b2832
description: The Universal Anomaly Event provides a standardized way to identify and categorize anomaly threat detection events across multiple domains.
products:
  - Cross Cloud Packages Solutions
release: "260"
---
# Universal Anomaly Event

The Universal Anomaly Event provides a standardized way to identify and categorize anomaly threat detection events across multiple domains.

**Where:** This change applies to Lightning Experience in Enterprise, Performance, Unlimited, and Developer editions.

**Who:** This change is available to users with the Event Monitoring or Salesforce Shield license.

**Why:** This event acts as a unifying anomaly classification layer. Use the subtype field to identify anomaly types available via Shield Event Monitoring.

The Universal Anomaly Event does not currently include detailed anomaly payloads or detection-specific metrics. Use the Universal Anomaly Event to understand which threat detection events are triggered while using reports and dashboards to analyze threat detection patterns.