---
schema_version: "1"
id: 998518c7856c1a81ac4a25019111cd7d460a31d528d079cf81b9fae15ca9b145
title: Investigate Report Anomalies
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/real_time_em_threat_detection_review.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_review.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 08ddd236d61ef61ac60fec24baa2a7c49302e78fc9fba7cef48b0f02f89fe372
description: It's often necessary to further investigate a report anomaly to either rule it out as benign or to determine if a data breach occurred.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# Investigate Report Anomalies

It's often necessary to further investigate a report anomaly to either rule it out as benign or to determine if a data breach occurred.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in both Salesforce Classic (not available in all orgs) and Lightning
            Experience.</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
              Editions</p>
            <p style="margin-bottom:0;">Requires Salesforce Shield or Salesforce Event Monitoring add-on
              subscriptions.</p>
          </td>

        </tr>
      </tbody>
    </table>

As a Shield customer, the Real-Time Event Monitoring events provide you with the required information to perform your investigation. In particular:

- ReportAnomalyEvent (and its storage equivalent ReportAnomalyEventStore) track when anomalies are detected about users running or exporting reports. These objects are the starting point of your investigation.
- ReportEventStream (and its storage equivalent ReportEvent) track in general when users run or export reports in your org. Use these objects to see real-time or historical report executions.
- LoginEventStream (and its storage equivalent LoginEvent) track all login activity in your org.

For example, say that your org receives a ReportAnomalyEvent that indicates a potential anomaly in a user’s report execution. The first thing you do is look at relevant fields of the event to get basic information about the anomaly, such as:

- Score: A number that represents how much this user’s report execution differed from their usual activity. The higher the number, the more it diverged.
- UserId: The user’s unique ID.
- EventDate: When this anomaly occurred.
- Report: The report ID for which this anomaly was detected.
- SecurityEventData: JSON field that contains the features, such as row count or day of the week, that contributed the most to this anomaly detection.
- Summary: A text summary of the event.

See the [API documentation](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_reportanomalyevent.htm) for the full list of fields.

This sample SOQL query returns these field values.

```sql
SELECT Score, UserId, EventDate, Report, SecurityEventData, Summary
FROM ReportAnomalyEventStore
```

Let’s look at the SecurityEventData field a bit more closely because it contains the contributing factors that triggered this anomaly detection. Here’s sample data:

```
[
{
"featureName": "rowCount",
"featureValue": "1937568",
"featureContribution": “95.00 %"
},
{
"featureName": "autonomousSystem",
"featureValue": "Bigleaf Networks, Inc.",
"featureContribution": “1.62 %"
},
{
"featureName": "dayOfWeek",
"featureValue": "Sunday",
"featureContribution": “1.42 %"
},
{
"featureName": "userAgent",
"featureValue": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36}",
"featureContribution": “1.21 %"
},
{
"featureName": "periodOfDay",
"featureValue": “Evening”,
"featureContribution": “.09 %"
},
{
"featureName": "averageRowSize",
"featureValue": "744",
"featureContribution": “0.08 %"
},
{
"featureName": "screenResolution",
"featureValue": "900x1440",
"featureContribution": “0.07 %"
}
]
```

The feature that contributed the most (95.00%) to this anomaly detection was rowCount with a value of 1937568. The feature indicates that the user viewed or exported a report that had 1,937,568 rows. But based on historical data, the user rarely views or exports so much data. The other features contributed much less to the score. For example, the user executed the report on Sunday, but this feature contributed only 1.42% to the overall score.

Now that you have the data, you can investigate further.

#### See Also

- [Training and Inference Steps](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_steps.htm&release=264.0.0&type=5 "Similar to other machine learning or statistical models, our detection model has a familiar two-step process: a training step and an inference or detection step. As a customer, you don't perform either of these steps—Salesforce performs them for you. You only review the detection events generated by our detection mode and take further action if necessary.")
- [_Platform Events Developer Guide_: ReportAnomalyEvent](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_reportanomalyevent.htm)
- [_Platform Events Developer Guide_: ReportEvent](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_reportevent.htm)