Here are several examples that illustrate how you can investigate anomalous report events thoroughly.
Required Editions
| Available in both Salesforce Classic (not available in all orgs) and Lightning Experience. |
|
Available in: Enterprise, Unlimited, and Developer Editions Requires Salesforce Shield or Salesforce Event Monitoring add-on subscriptions. |
- Detection Event Isn’t Anomalous
Jason is a sales data analyst who reports to the regional sales manager. It’s Jason’s job to generate reports for his manager’s sales calls. On March 27, 2019, Jason’s account was used to generate a report. Alia, the administrator for Jason’s org, noticed a ReportAnomalyEvent about this report generation activity. - Detection Event Possibly Anomalous
Rob recently joined the company as a customer success representative. On Jan 15, 2019, Rob’s account was used to generate a report. Tony, the org’s Salesforce admin, noticed a ReportAnomalyEvent about this report generation activity. - Detection Event Is Definitely Anomalous but Maybe Not Malicious
Alice is a sales rep based in St. Louis. She’s often on the road to meet with clients. When she travels, she generally, but not consistently, use her company’s VPN to log into Salesforce. - Detection Event Is Confirmed Malicious
John, a sales rep based in San Francisco, often travels for work. He regularly downloads reports of his leads for his weekly sales presentations. John has access to 500-1,000 leads and his weekly report downloads typically contain 500–1,000 rows.