---
schema_version: "1"
id: 53969fb8bd99ae35387d0dac88afa782f1cb676b93046d5f5c3426c8a359a85d
title: Investigate Credential Stuffing
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/real_time_em_threat_credstuff_review.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_credstuff_review.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 14080f77ef2bd1a4bd3640d6b1b8e4d8659ecf6be9a3fa9fb24b15d26a11a58b
description: Here are some tips for investigating a credential stuffing attack.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# Investigate Credential Stuffing

Here are some tips for investigating a credential stuffing attack.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in both Salesforce Classic (not available in all orgs) and Lightning
            Experience.</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
              Editions</p>
            <p style="margin-bottom:0;">Requires Salesforce Shield or Salesforce Event Monitoring add-on
              subscriptions.</p>
          </td>

        </tr>
      </tbody>
    </table>

Start by querying these Real-Time Event Monitoring events that provide detailed information about the attack. In particular:

- CredentialStuffingEvent and its storage equivalent CredentialStuffingEventStore track when a user successfully logs into Salesforce during an identified credential stuffing attack.
    
    ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/images/icon_important.png)
    
    Important If the CredentialStuffingEvent object contains a record, an attack occurred in the past and _Salesforce security has already taken care of the security issue_. You don’t do anything other than investigate the attack for your own purposes.
- LoginEventStream and its storage equivalent LoginEvent track all login activity in your Salesforce org.

For example, say that your org receives a CredentialStuffingEvent. The first thing you do is look at relevant fields of the event to get basic information about the attack, such as:

- UserId: The user’s unique ID. Use this ID to query LoginEvent for more login information.
- EventDate: When this attack occurred.
- Summary: A text summary of the event.

See the [API documentation](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_credentialstuffingevent.htm) for the full list of fields.

This sample SOQL query returns these field values.

```sql
SELECT UserId, EventDate, Summary FROM CredentialStuffingEventStore
```

You can use this type of query to identify the users in your org that were affected by the credential stuffing attack. These users reused their org password in other websites or their password follows a common pattern and isn’t strong enough. Educate your users on how they can create and manage strong passwords to protect your org.

Also consider improving your security with password protection. You can set password history, length, and complexity requirements. You can also specify what to do when a user forgets the password. Salesforce requires the use of multi-factor authentication (MFA) for all logins to the user interface — make sure MFA is enabled for all your users. Finally, investigate enabling Lightning Login for password-free logins.

#### See Also

- [_Salesforce Help_: Enable Lightning Login for Password-Free Logins](https://help.salesforce.com/articleView?id=security_ll_enable.htm&language=en_US)
- [_Trailhead_: Educate Your Users to Help Protect Your Org](https://trailhead.salesforce.com/en/content/learn/modules/security_basics/security_basics_users)
- [_Salesforce Security Guide_: Set Password Policies](https://developer.salesforce.com/docs/atlas.en-us.securityImplGuide.meta/securityImplGuide/admin_password.htm)
- [_Platform Events Developer Guide_: CredentialStuffingEvent](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_credentialstuffingevent.htm)