---
schema_version: "1"
id: 3d358d2e0cae6b0d32134ef661e2a6a2f4c4c0502026accd78885ed5dfd99dc8
title: Login Anomaly
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/real_time_em_threat_detection_login_anomaly.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_login_anomaly.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: c3ced46b4d184030ea9ceaa5a4376742035b578f4593e21d4cd1d0bc4fc0bd6a
description: An anomalous login refers to the detection of a potential attacker attempting to gain unauthorized access to a legitimate user's account. This threat detection event identifies login attempts that deviate significantly from a user's typical login behavior, such as unusual times of day, unfamiliar devices (endpoints), or unexpected locations. Detecting these anomalies early is critical as a successful login is often the first step in broader malicious activities like data exfiltration or the deployment of malware and phishing campaigns.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# Login Anomaly

An anomalous login refers to the detection of a potential attacker attempting to gain unauthorized access to a legitimate user's account. This threat detection event identifies login attempts that deviate significantly from a user's typical login behavior, such as unusual times of day, unfamiliar devices (endpoints), or unexpected locations. Detecting these anomalies early is critical as a successful login is often the first step in broader malicious activities like data exfiltration or the deployment of malware and phishing campaigns.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in both Salesforce Classic (not available in all orgs) and Lightning
            Experience.</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
              Editions</p>
            <p style="margin-bottom:0;">Requires Salesforce Shield or Salesforce Event Monitoring add-on
              subscriptions.</p>
          </td>

        </tr>
      </tbody>
    </table>

- **[Investigate Login Anomalies](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_questions_for_investigation.htm&release=264.0.0&type=5)**  
    It's often necessary to further investigate a login anomaly to determine if a login was unauthorized or to rule it out as benign.
- **[Best Practices and Additional Information for Anomalous Logins](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_login_anomaly_best_practices.htm&release=264.0.0&type=5)**  
    Understanding the nature of anomalous logins and available resources can help you manage and respond to these events effectively.