An anomaly is any user activity that is sufficiently different from the
historical activity of the same user. We use the metadata in Salesforce Core application logs
about API generation and surrounding activities to build a baseline model of the historical
activity. We then compare any new API generation activity against this baseline to determine if
the new activity is sufficiently different to be called an anomaly. We don't look at the actual
data that a user interacts with— we look at how the user interacts with the
data.
Required Editions
| Available in both Salesforce Classic (not available in all orgs) and Lightning
Experience. |
|
Available in: Enterprise, Unlimited, and Developer
Editions
Requires Salesforce Shield or Salesforce Event Monitoring add-on
subscriptions.
|
- Training and Inference Steps
Similar to other machine learning or statistical models, our detection model has a familiar two-step process: a training step and an inference or detection step. As a customer, you don't perform either of these steps—Salesforce performs them for you. You only review the detection events generated by our detection mode and take further action if necessary.
- Investigate API Request Anomalies
It's often necessary to further investigate an API request anomaly to either determine if a data breach occurred or to rule it out as benign.
- Best Practices for Investigating API Request Anomalies
Keep these tips and best practices in mind when you investigate unusual user behavior. Find the information you require to make a well-informed evaluation of your data’s safety.
- API Request Anomaly Detection Examples
Here are several examples that illustrate how you can investigate anomalous API request events thoroughly.
