---
schema_version: "1"
id: b5e8cab81194df752fef784ba7d0696104d8e5dd338f512337b40a14d54ebb12
title: Report Anomaly Detection Examples
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/real_time_em_threat_detection_examples.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_examples.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 2fa6274fe267c7a268991114fd1c0a6c8d9c0e879936a7afaf929479e193515d
description: Here are several examples that illustrate how you can investigate anomalous report events thoroughly.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# Report Anomaly Detection Examples

Here are several examples that illustrate how you can investigate anomalous report events thoroughly.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in both Salesforce Classic (not available in all orgs) and Lightning
            Experience.</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
              Editions</p>
            <p style="margin-bottom:0;">Requires Salesforce Shield or Salesforce Event Monitoring add-on
              subscriptions.</p>
          </td>

        </tr>
      </tbody>
    </table>

- **[Detection Event Isn’t Anomalous](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_examples_notanomalous.htm&release=264.0.0&type=5)**  
    Jason is a sales data analyst who reports to the regional sales manager. It’s Jason’s job to generate reports for his manager’s sales calls. On March 27, 2019, Jason’s account was used to generate a report. Alia, the administrator for Jason’s org, noticed a ReportAnomalyEvent about this report generation activity.
- **[Detection Event Possibly Anomalous](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_examples_maybeanomalous.htm&release=264.0.0&type=5)**  
    Rob recently joined the company as a customer success representative. On Jan 15, 2019, Rob’s account was used to generate a report. Tony, the org’s Salesforce admin, noticed a ReportAnomalyEvent about this report generation activity.
- **[Detection Event Is Definitely Anomalous but Maybe Not Malicious](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_examples_anomalous.htm&release=264.0.0&type=5)**  
    Alice is a sales rep based in St. Louis. She’s often on the road to meet with clients. When she travels, she generally, but not consistently, use her company’s VPN to log into Salesforce.
- **[Detection Event Is Confirmed Malicious](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_examples_malicious.htm&release=264.0.0&type=5)**  
    John, a sales rep based in San Francisco, often travels for work. He regularly downloads reports of his leads for his weekly sales presentations. John has access to 500-1,000 leads and his weekly report downloads typically contain 500–1,000 rows.