---
schema_version: "1"
id: 59e25b4b823c7ce5cbf254bbb22328a710b69712d1a4a8b8bd387469b8f8fde0
title: Best Practices for Investigating Guest User Anomalies
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/real_time_em_threat_detection_investigate_guest_user_anomaly.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_investigate_guest_user_anomaly.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: ff86551f57b24925e15aed27c198b3be413a54c228bc969ff8a7dc0fe69cd52c
description: Keep these tips in mind when you investigate unusual user behavior to ensure your data stays secure.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# Best Practices for Investigating Guest User Anomalies

Keep these tips in mind when you investigate unusual user behavior to ensure your data stays secure.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in both Salesforce Classic (not available in all orgs) and Lightning
            Experience.</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
              Editions</p>
            <p style="margin-bottom:0;">Requires Salesforce Shield or Salesforce Event Monitoring add-on
              subscriptions.</p>
          </td>

        </tr>
      </tbody>
    </table>

We recommend that you review the following settings.

- **Organization Wide Default (OWD) Sharing Settings:**
    - Guest user external org-wide defaults are set to private.
    - Guest users can’t have more than read access to data.
    - Guest users can only get access to records through guest user sharing rules, a special type of criteria-based sharing rule.
- **Guest User Profiles:**
    - A suspicious event caused by guest user profiles likely means that guest users accessed objects via Apex and submitted SOQL queries that have returned results. Review any Create, Read, Update, Delete (CRUD) access owned by each standard or custom object within guest user profiles.

To generate a report showing your current Guest User access and permissions, use the Authenticated and Guest User Access Report and Monitoring app, which can be found in the AppExchange marketplace.

See these best practices to ensure that you are keeping your orgs with guest users secure: [Manage Users and Data Access.](https://help.salesforce.com/s/articleView?id=platform.users_manage_access.htm&type=5&language=en_US)