---
schema_version: "1"
id: 8ecdd654d2f76f06072716ec7382386af6c171f73fb6a083c0da772bf2f3f6dc
title: API Anomaly
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/real_time_em_threat_apianomaly.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_apianomaly.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 1f9ee71bf8d417fc85fa1f16f224ba23f9f2961bf707936e656c4d261638304a
description: An anomaly is any user activity that is sufficiently different from the historical activity of the same user. We use the metadata in Salesforce Core application logs about API generation and surrounding activities to build a baseline model of the historical activity. We then compare any new API generation activity against this baseline to determine if the new activity is sufficiently different to be called an anomaly. We don't look at the actual data that a user interacts with— we look at how the user interacts with the data.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# API Anomaly

An _anomaly_ is any user activity that is sufficiently different from the historical activity of the same user. We use the metadata in Salesforce Core application logs about API generation and surrounding activities to build a baseline model of the historical activity. We then compare any new API generation activity against this baseline to determine if the new activity is sufficiently different to be called an anomaly. We don't look at the actual data that a user interacts with— we look at _how_ the user interacts with the data.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in both Salesforce Classic (not available in all orgs) and Lightning
            Experience.</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
              Editions</p>
            <p style="margin-bottom:0;">Requires Salesforce Shield or Salesforce Event Monitoring add-on
              subscriptions.</p>
          </td>

        </tr>
      </tbody>
    </table>

- **[Training and Inference Steps](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_steps.htm&release=264.0.0&type=5)**  
    Similar to other machine learning or statistical models, our detection model has a familiar two-step process: a training step and an inference or detection step. As a customer, you don't perform either of these steps—Salesforce performs them for you. You only review the detection events generated by our detection mode and take further action if necessary.
- **[Investigate API Request Anomalies](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_investigate_api_anomaly.htm&release=264.0.0&type=5)**  
    It's often necessary to further investigate an API request anomaly to either determine if a data breach occurred or to rule it out as benign.
- **[Best Practices for Investigating API Request Anomalies](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_api_bestpractices.htm&release=264.0.0&type=5)**  
    Keep these tips and best practices in mind when you investigate unusual user behavior. Find the information you require to make a well-informed evaluation of your data’s safety.
- **[API Request Anomaly Detection Examples](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_api_anomaly_examples.htm&release=264.0.0&type=5)**  
    Here are several examples that illustrate how you can investigate anomalous API request events thoroughly.