--- schema_version: "1" id: 5fd833f8a1f7474b0b475a682513370a2049deb901a2bf623052041441e72b94 title: Condition Builder Examples collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/enhanced_transaction_security_cb_examples.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.enhanced_transaction_security_cb_examples.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: ef9de6ad45789bdb5995b4747bcc3306a8818c19000a44f9f8dc46af70f88c33 description: Use these examples to help you convert your own real-world use cases into Condition Builder conditions. products: - Salesforce Platform - Cross Cloud release: "264" --- # Condition Builder Examples Use these examples to help you convert your own real-world use cases into Condition Builder conditions. ### Required Editions
Available in both Salesforce Classic (not available in all orgs) and Lightning Experience.

Available in: Enterprise, Unlimited, and Developer Editions

Requires Salesforce Shield or Salesforce Event Monitoring add-on subscriptions.
## Track Report Executions Track when a user views or exports more than 2,000 rows from any report on the Lead object. - Event: Report Event - Condition Logic: All Conditions Are Met - Conditions: - `Rows Processed Greater Than 2,000` - `Queried Entities Contains Lead` - Notes: Use the **Contains** operator, rather than **Equals**, to also include reports that are based on multiple objects, one of which is Lead. ![Condition Builder conditions](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/setup/images/cb_example_one.png) Description of Example: Track when a user views or exports a report that has a column that contains email addresses. - Event: Report Event - Condition Logic: All Conditions Are Met - Conditions: `Name of Columns Contains Email` - Notes: Use the **Contains** operator to include any of these column names: `Email`, `Customer Email`, or `Email of Customer`. ![Condition Builder conditions](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/setup/images/cb_example_seven.png) ## Track User Logins Description of Example: Track when a user logs in from the IP address 12.34.56.78. - Event: Login Event - Condition Logic: All Conditions Are Met - Conditions: `Source IP Equals 12.34.56.78` - Notes: Only the specific IP address 12.34.56.78 triggers the policy. If you want to track logins from any IP addresses that start with 12.34.56, use the condition `Source IP Starts With 12.34.56`. ![Condition Builder conditions](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/setup/images/cb_example_two.png) Description of Example: Track when a user logs in using a Chrome browser. - Event: Login Event - Condition Logic: All Conditions Are Met - Conditions: `Browser Contains Chrome` - Notes: You can also track logins from the Safari and Firefox browsers. ![Condition Builder conditions](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/setup/images/cb_example_five.png) ## Track API Queries and Elapsed Time Description of Example: Track when a user uses any API to query the Lead object and the request takes longer than 1,000 milliseconds. - Event: API Event - Condition Logic: All Conditions Are Met - Conditions: - `Queried Entities Contains Lead` - `Elapsed Time Greater Than 1000` - Notes: Use the **Contains** operator, rather than **Equals**, to also include queries on multiple objects, of which one is Lead. ![Condition Builder conditions](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/setup/images/cb_example_three.png) ## Track API Queries of Any List View Description of Example: Track when a user uses any API to query any list view. - Event: List View Event - Condition Logic: All Conditions Are Met - Conditions: `Event Source Equals API` - Notes: To track when a user uses the UI to query a list view specify `Classic` or `Lightning` instead of `API`. ![Condition Builder conditions](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/setup/images/cb_example_four.png) ## Track User's Session Level Security Description of Example: Track when a user who doesn’t have high assurance session-level security access (not logged in with two-factor authentication) queries any list view. - Event: List View Event - Condition Logic: Any Condition Is Met - Conditions: - `Session Level Equals LOW` - `Session Level Equals STANDARD` - Notes: Track when a user without high assurance executes a report (Report Event) or an API query (API Event) using the same condition in separate transaction security policies. ![Condition Builder conditions](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/setup/images/cb_example_eight.png) ## Track Assignments of Modify All Data Permission Description of Example: Track when a user is assigned the Modify All Data permission. - Event: Permission Set Event Store - Condition Logic: All Conditions Are Met - Conditions: `Permission Type Contains ModifyAllData` - Notes: Use the `Contains` operator, rather than `Equals` for permission set events. The value must be the API name of the permission. ![Condition Builder conditions for a permission set event.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/setup/images/cb_example_permission_event.png) ## Block File Download Description of Example: Detect and block a user from downloading a specific file. - Event: File Event - Condition Logic: Any Condition Is Met - Conditions: - `File Name Equals Asset.pdf` ![Condition Builder conditions](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/setup/images/cb_example_ten.png) ## Use Custom Logic Description of Example: Track when a user with a username in the `@spy.mycompany.com` domain queries all the records in a list view named SuperSecureListView. - Event: List View Event - Condition Logic: Custom Condition Logic is Met - Custom Condition Logic: `(1 OR 2) AND 3` - Conditions: - `Scope Equals Everything` - `Name Equals SuperSecureListView` - `Username Ends With @spy.mycompany.com` - Notes: ![Condition Builder conditions](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/setup/images/cb_example_nine.png)