Here are several examples that illustrate how you can investigate anomalous API request events thoroughly.
Required Editions
| Available in both Salesforce Classic (not available in all orgs) and Lightning Experience. |
|
Available in: Enterprise, Unlimited, and Developer Editions Requires Salesforce Shield or Salesforce Event Monitoring add-on subscriptions. |
- API Detection Event Isn’t Anomalous
Jason, a developer, uses APIs to query an Account object on a Sunday. He retrieves 10,000 records. - API Detection Event Possibly Anomalous
Rob, a relatively new Sales Operation Lead, uses an API to query the Opportunity object and extracts 10 million records. He previously queried the same object using a different browser and from a different IP address. - API Detection Event Is an Anomaly but Isn’t Clearly Malicious
Alice is a sales rep based in St. Louis. She’s often on the road to meet with clients. When she travels, she generally, but not consistently, uses her company’s VPN to log into Salesforce. - API Detection Event Is Confirmed Malicious
Alan, a Salesforce user, employs an API to query the Opportunity object and extracts 10 million records. It’s the first time that Alan queries the Opportunity object and uses this IP address to log in.