--- schema_version: "1" id: be27d489c448ce93d1ea41c1a958e2e2cbd475fd60a40c8722758d505526d5dd title: Threat Detection collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/real_time_em_threat_detection.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: b889108aca5479fb774e8db9569b0397899879b10ccb6104ebc0654d6d713a8e description: Threat Detection uses statistical and machine learning methods to detect threats to your Salesforce org. While Salesforce identifies these threats for all Salesforce customers, you can view the information in the events with Threat Detection in Event Monitoring and investigate further if necessary. Threat Detection events do not count towards standard object storage limits. products: - Salesforce Platform - Cross Cloud release: "264" --- # Threat Detection Threat Detection uses statistical and machine learning methods to detect threats to your Salesforce org. While Salesforce identifies these threats for all Salesforce customers, you can view the information in the events with Threat Detection in Event Monitoring and investigate further if necessary. Threat Detection events do not count towards standard object storage limits. ### Required Editions
Available in both Salesforce Classic (not available in all orgs) and Lightning Experience.

Available in: Enterprise, Performance, and Unlimited Editions

Requires Salesforce Shield or Salesforce Event Monitoring add-on subscriptions.
Threat Detection identifies: - If a user session is hijacked - When large-scale automated login requests use stolen user credentials to gain access to Salesforce - Anomalies in a user's report views or exports - Anomalies in how users make API calls - Anomalies in guest user activity - Anomalies in login attempts ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/images/icon_note.png) Note The Machine Learning (ML) models that power Threat Detection analyze data to ensure accurate identification, which requires a brief processing time. This results in an expected time difference between the Event Detection Date and the Event Creation Date. ![Warning](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/images/icon_warning.png) Warning Not all third-party proxies pass network-related parameters, such as IP addresses, into Salesforce. Without network-related parameters, Salesforce doesn’t detect all threats to these proxies. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/images/icon_note.png) Note While the UI may be visible, Threat Detection is not supported in Government Cloud. ## Respond to Detected Threat Events Use Threat Detection to plan and implement appropriate responses that keep your data safe. When we detect anomalous activity, the resulting Threat Detection events are compatible with transaction security policies and flows.
Response Method Description
Use Transaction Security Policies to Monitor Threats

Create a transaction security policy on the Threat Detection events that generate email or in-app notifications when Salesforce detects a threat. After investigating the detected threat, consider creating a policy to control users' behavior.

For example, you receive multiple ReportAnomalyEvents about a user who exported many more records of a report on Leads than usual. Because you created a transaction security policy on ReportAnomalyEventStore, you receive a notification each time this anomaly occurs. To further protect the Lead object, you can create a ReportEvent policy on the report to block users from exporting more than 10 rows.
Automate Responses with Platform Event-Triggered Flows You can build flows to respond to anomalies detected on the ApiAnomalyEvent, CredentialStuffingEvent, ReportAnomalyEvent, and SessionHijackingEvent. For example, create flows that generate a case for a follow-up investigation, send an email to a security specialist, or deactivate an affected user pending further investigation.
Aggregate Detected Threats with Security Center You can save time by aggregating information on detected threats across your entire Salesforce rollout in one place with the Threat Detection app in Security Center. For more information, see Review Threat Detection Events
- **[Session Hijacking](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_session.htm&release=264.0.0&type=5)** Session Hijacking is a customer-focused attack where attackers try to steal information from using a client’s access to a web application. In our case, this application is Salesforce. When a client successfully authenticates with Salesforce, they receive a session token. The attacker tries to hijack the client’s session by obtaining their session token. - **[Credential Stuffing](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_credstuff.htm&release=264.0.0&type=5)** Credential stuffing is a type of cyber attack that uses stolen account credentials. It’s also known as “password spraying” or “credential spills”. Attackers obtain large numbers of usernames and passwords through data breaches or other types of cyber attacks. They then use these credentials to gain unauthorized access to user accounts through large-scale automated login requests against a web application such as Salesforce. - **[Report Anomaly](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_reportanomaly.htm&release=264.0.0&type=5)** An _anomaly_ is any user activity that is sufficiently different from the historical activity of the same user. We use the metadata in Salesforce Core application logs about report generation and surrounding activities to build a baseline model of the historical activity. We then compare any new report generation activity against this baseline to determine if the new activity is sufficiently different to be called an anomaly. We don't look at the actual data that a user interacts with— we look at _how_ the user interacts with the data. - **[API Anomaly](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_apianomaly.htm&release=264.0.0&type=5)** An _anomaly_ is any user activity that is sufficiently different from the historical activity of the same user. We use the metadata in Salesforce Core application logs about API generation and surrounding activities to build a baseline model of the historical activity. We then compare any new API generation activity against this baseline to determine if the new activity is sufficiently different to be called an anomaly. We don't look at the actual data that a user interacts with— we look at _how_ the user interacts with the data. - **[Guest User Anomaly](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_guest_user_anomaly.htm&release=264.0.0&type=5)** An _anomaly_ is any user activity that is sufficiently different from the other users. We use the metadata in Salesforce Core application logs to build profiles representing guest users’ data access activities. This threat detection event identifies suspicious attempts by guest users to access organization data. - **[View Threat Detection Events and Provide Feedback](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_td_ui.htm&release=264.0.0&type=5)** Launch the Threat Detection app and view all the detected threats that occurred in your Salesforce org. Threats include anomalies in how users run reports, session hijacking attempts, and credential stuffing. Use the same app to easily provide feedback about the severity of a specific threat. - **[Login Anomaly](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_login_anomaly.htm&release=264.0.0&type=5)** An anomalous login refers to the detection of a potential attacker attempting to gain unauthorized access to a legitimate user's account. This threat detection event identifies login attempts that deviate significantly from a user's typical login behavior, such as unusual times of day, unfamiliar devices (endpoints), or unexpected locations. Detecting these anomalies early is critical as a successful login is often the first step in broader malicious activities like data exfiltration or the deployment of malware and phishing campaigns. #### See Also - [_Platform Events Developer Guide_: Real-Time Event Monitoring Objects](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/platform_events_objects_monitoring.htm) - [_Platform Events Developer Guide_: Subscribe to Platform Event Messages with Flows](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/platform_events_subscribe_flow.htm) - [Transaction Security](https://help.salesforce.com/s/articleView?id=xcloud.enhanced_transaction_security_policy_types.htm&release=264.0.0&type=5 "Transaction Security is a framework that intercepts real-time events and applies appropriate actions to monitor and control user activity. Each transaction security policy has conditions that evaluate events and the real-time actions that are triggered after those conditions are met. The actions are Block, Multi-Factor Authentication, and Notifications. Before you build your policies, understand the available event types, policy conditions, and common use cases. Transaction Security is included in Real-Time Event Monitoring.") - [How Salesforce Helps Protect You From Insider Threats](https://engineering.salesforce.com/how-salesforce-helps-protect-you-from-insider-threats-5f9ae8b0e55d) - [How Salesforce Helps Protect You From Credential Stuffers](https://engineering.salesforce.com/how-salesforce-helps-protect-you-from-credential-stuffers-ffd2a9fe0330)