Guest User Anomaly

An anomaly is any user activity that is sufficiently different from the other users. We use the metadata in Salesforce Core application logs to build profiles representing guest users’ data access activities. This threat detection event identifies suspicious attempts by guest users to access organization data.

Required Editions

Available in both Salesforce Classic (not available in all orgs) and Lightning Experience.

Available in: Enterprise, Unlimited, and Developer Editions

Requires Salesforce Shield or Salesforce Event Monitoring add-on subscriptions.

Investigate Guest User Anomalies
It's often necessary to further investigate a guest user anomaly to determine if a data breach occurred or to rule it out as benign.
Best Practices for Investigating Guest User Anomalies
Keep these tips in mind when you investigate unusual user behavior to ensure your data stays secure.