---
schema_version: "1"
id: 307e43c9c29322429455778540d04bc2f9594bb0a18ac0ce377faab4b4eecc08
title: View Events and Provide Feedback
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/real_time_em_td_ui_view_and_feedback.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_td_ui_view_and_feedback.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 31c7ddb6524f1fcaf731c5906da781eb1e24fdef2cb65f1c0049fadbc2f53b62
description: "View recent or all Threat Detection events using the Threat Detection app in the Salesforce UI. The displayed events are stored in their corresponding storage objects: ReportAnomalyEventStore, SessionHijackingEventStore, and CredentialStuffingEventStore. Associate a feedback object with a particular event to record the severity of the threat, such as Malicious or Not a Threat."
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# View Events and Provide Feedback

View recent or all Threat Detection events using the Threat Detection app in the Salesforce UI. The displayed events are stored in their corresponding storage objects: ReportAnomalyEventStore, SessionHijackingEventStore, and CredentialStuffingEventStore. Associate a feedback object with a particular event to record the severity of the threat, such as Malicious or Not a Threat.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
        <colgroup>
          <col>
        </colgroup>
        <tbody>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">Available in both Salesforce Classic (not available in all orgs) and Lightning
              Experience.</td>

          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">
              <p>Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
                Editions</p>
              <p style="margin-bottom:0;">Requires Salesforce Shield or Salesforce Event Monitoring add-on
                subscriptions.</p>
            </td>

          </tr>
        </tbody>
      </table>

 
| User Permissions Needed |   |
| --- | --- |
| To view the Threat Detection events: | View Threat Detection Events |

By default, the Threat Detection app isn’t visible in Salesforce. If necessary, make it visible as described in [Make the Threat Detection App Visible to Users](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_td_ui_enable_app.htm&release=264.0.0&type=5 "Before you can view the Threat Detection events in Salesforce and provide feedback, you must make the app visible to users. You also specify which of the tabs are visible to different user profiles.").

1. From App Launcher, click **Threat Detection**.
    
    ![App Launcher with Threat Detection app highlighted.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/setup/images/rtem_td_ui_app.png)
2. Click the tabs for list views of recent or all events stored in the GuestUserAnomalyEventStore, ReportAnomalyEventStore, SessionHijackingEventStore, ApiAnomalyEventStore, or CredentialStuffingEventStore objects.
3. To view an event’s details, click its link. Information such as the date the event occurred, its score, and a summary of the event is displayed.
    
    Each type of event displays other details appropriate to the type of detected threat. For example, the Session Hijacking Event Store tab displays previous and current browser fingerprint information. The Report Anomaly Event Store tab displays the report ID associated with the detected threat.
    
    Click Related to view the associated feedback, if any.
4. Click Provide Feedback to specify whether a specific detected threat is Malicious, Suspicious, Not a Threat, or Unknown.
    
    You can associate only one feedback object with each event. If you try to provide more than one feedback object, you get an error. If the severity of a threat changes after you provided feedback, edit the response.
    
    ![Guest User Anomaly Event details page with Provide Feedback button highlighted](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/setup/images/rtem_td_ui_feedback.png)

#### See Also

- [_Platform Events Developer Guide_: Real-Time Event Monitoring Objects](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/platform_events_objects_monitoring.htm)