---
schema_version: "1"
id: 6cc344ff06a5bd29d03a8e5aea0efeb04b2d67e97c442b70e139a8630404c434
title: Guest User Anomaly
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/real_time_em_threat_detection_guest_user_anomaly.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_guest_user_anomaly.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 8df47e00bc1050b3442a9f21be1af5bca7eb06b1f14837ca051cbb01e8a1b5d1
description: An anomaly is any user activity that is sufficiently different from the other users. We use the metadata in Salesforce Core application logs to build profiles representing guest users’ data access activities. This threat detection event identifies suspicious attempts by guest users to access organization data.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# Guest User Anomaly

An _anomaly_ is any user activity that is sufficiently different from the other users. We use the metadata in Salesforce Core application logs to build profiles representing guest users’ data access activities. This threat detection event identifies suspicious attempts by guest users to access organization data.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in both Salesforce Classic (not available in all orgs) and Lightning
            Experience.</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
              Editions</p>
            <p style="margin-bottom:0;">Requires Salesforce Shield or Salesforce Event Monitoring add-on
              subscriptions.</p>
          </td>

        </tr>
      </tbody>
    </table>

- **[Investigate Guest User Anomalies](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_steps_guest_user_anomaly.htm&release=264.0.0&type=5)**  
    It's often necessary to further investigate a guest user anomaly to determine if a data breach occurred or to rule it out as benign.
- **[Best Practices for Investigating Guest User Anomalies](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_investigate_guest_user_anomaly.htm&release=264.0.0&type=5)**  
    Keep these tips in mind when you investigate unusual user behavior to ensure your data stays secure.