---
schema_version: "1"
id: d070e0c6a0d0a3bd2f84f2b1a69cb946aa01a56b810e42ab99d5bc2e05733b8d
title: Investigate API Request Anomalies
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/real_time_em_threat_detection_investigate_api_anomaly.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_investigate_api_anomaly.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: b082794adb3f357b3c1a9f3b0b69bff8f4a0c0d2f2d47005ccd58442d23839c2
description: It's often necessary to further investigate an API request anomaly to either determine if a data breach occurred or to rule it out as benign.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# Investigate API Request Anomalies

It's often necessary to further investigate an API request anomaly to either determine if a data breach occurred or to rule it out as benign.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in both Salesforce Classic (not available in all orgs) and Lightning
            Experience.</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
              Editions</p>
            <p style="margin-bottom:0;">Requires Salesforce Shield or Salesforce Event Monitoring add-on
              subscriptions.</p>
          </td>

        </tr>
      </tbody>
    </table>

As a Shield customer, the Real-Time Event Monitoring events provide you with the required information to perform your investigation. In particular:

- ApiAnomalyEvent and its storage equivalent ApiAnomalyEventStore track anomalies in how users make API calls. These objects are the starting point of your investigation.
- ApiEventStream and its storage equivalent ApiEvent track user-initiated read-only API calls. Use these objects to see real-time or historical API executions.
- LoginEventStream (and its storage equivalent LoginEvent) track all login activity in your org.

For example, say that your org receives an ApiAnomalyEvent that indicates a potential anomaly in a user’s API calls. The first thing you do is look at relevant fields of the event to get basic information about the anomaly, such as:

- Score: A number that represents how much this user’s API activity differed from their usual activity. The higher the number, the more it diverged.
- UserId: The user’s unique ID.
- EventDate: The time that the API request occurred.
- SecurityEventData: JSON field that contains the features, such as row count or day of the week, that contributed the most to this anomaly detection.
- Summary: A text summary of the event.

See the [API documentation](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_apianomalyevent.htm) for the full list of fields.

This sample SOQL query returns these field values.

```sql
SELECT Score, UserId, EventDate, SecurityEventData, Summary
FROM ApiAnomalyEventStore
```

Let’s look at the SecurityEventData field a bit more closely because it contains the contributing factors that triggered this anomaly detection. Here’s sample data:

```
[
{
"featureName": "rowCount",
"featureValue": "1937568",
"featureContribution": “95.00 %"
},
{
"featureName": "autonomousSystem",
"featureValue": "Bigleaf Networks, Inc.",
"featureContribution": “1.62 %"
},
{
"featureName": "dayOfWeek",
"featureValue": "Sunday",
"featureContribution": “1.42 %"
},
{
"featureName": "userAgent",
"featureValue": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36}",
"featureContribution": “1.21 %"
},
{
"featureName": "periodOfDay",
"featureValue": “Evening”,
"featureContribution": “.09 %"
},
{
"featureName": "averageRowSize",
"featureValue": "744",
"featureContribution": “0.08 %"
},
{
"featureName": "screenResolution",
"featureValue": "900x1440",
"featureContribution": “0.07 %"
}
]
```

The feature that contributed the most (95.00%) to this anomaly detection was rowCount with a value of 1937568. The feature indicates that the user viewed or exported a report that had 1,937,568 rows. But based on historical data, the user rarely views or exports so much data. The other features contributed much less to the score. For example, the user executed the report on Sunday, but this feature contributed only 1.42% to the overall score.

Now that you have the data, you can investigate further.

#### See Also

- [_Platform Events Developer Guide_: ApiAnomalyEvent](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_apianomalyevent.htm?q=API%20Anomaly)
- [_Platform Events Developer Guide_: ApiEvent](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_apievent.htm)