---
schema_version: "1"
id: ce8752ed28db64336772a1be791fe10cfd571d164facaee3609dff6175923f72
title: Investigate Guest User Anomalies
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/real_time_em_threat_detection_steps_guest_user_anomaly.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_steps_guest_user_anomaly.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 4105d59a48512a0a8432424381c8d1ddc3f3e3fff1c65bbbf62fceb0ea062380
description: It's often necessary to further investigate a guest user anomaly to determine if a data breach occurred or to rule it out as benign.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# Investigate Guest User Anomalies

It's often necessary to further investigate a guest user anomaly to determine if a data breach occurred or to rule it out as benign.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in both Salesforce Classic (not available in all orgs) and Lightning
            Experience.</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
              Editions</p>
            <p style="margin-bottom:0;">Requires Salesforce Shield or Salesforce Event Monitoring add-on
              subscriptions.</p>
          </td>

        </tr>
      </tbody>
    </table>

As a Shield customer, the Real-Time Event Monitoring events provide you with the required information to perform your investigation and ensure your data is secure. In particular:

- GuestUserAnomalyEvent and its storage equivalent GuestUserAnomalyEventStore. This entity helps detect data access anomalies caused by guest user permission misconfiguration. These objects are the starting point of your investigation.

For example, say that your org receives a GuestUserAnomalyEvent that indicates a potential anomaly in a guest user’s data access attempt. The first thing you do is look at relevant fields of the event to get basic information about the anomaly, such as:

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
      <colgroup>
        <col style="width:28.000000000000004%">
        <col style="width:72%">
      </colgroup>
      <thead class="slds-text-title_caps ">
        <tr class="">
          <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d70742e81">Field</th>
          <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d70742e84">Description</th>
        </tr>
      </thead>
      <tbody>
        <tr class="">
          <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d70742e81 ">
            <samp class="parmname">RequestedEntities</samp>
          </td>

          <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d70742e84 ">
            <p>Objects that are queried by the guest user. For
              example:</p>
            <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code class="nolang">[" Topic "]</code></pre>
          </td>

        </tr>
        <tr class="">
          <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d70742e81 ">
            <samp class="parmname">Score</samp>
          </td>

          <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d70742e84 ">Specifics how significantly the guest user behavior deviates from the other guest
            users. It’s formatted as a number between 0 and 1. A higher score means a greater
            deviation.</td>

        </tr>
        <tr class="">
          <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d70742e81 ">
            <samp class="parmname">SoqlCommands</samp>
          </td>

          <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d70742e84 ">
            <p>SOQL commands run by the guest user. For
              example:</p>
            <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code class="language-sql">["SELECT Name, Description, CreatedDate, Id, SystemModstamp FROM Topic ORDER BY Name ASC, Id ASC LIMIT 1000","SELECT COUNT() FROM Topic LIMIT 2000"]
</code></pre>
          </td>

        </tr>
        <tr class="">
          <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d70742e81 ">
            <samp class="parmname">Summary</samp>
          </td>

          <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d70742e84 ">
            <p>A text summary of the threat that caused this event to be created. The summary
              lists the browser fingerprint features that most contributed to the threat detection
              along with their contribution to the total score. For
              example:</p>
            <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code class="nolang"> Anomaly in SelectData Controller behavior</code></pre>
          </td>

        </tr>
        <tr class="">
          <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d70742e81 ">
            <samp class="parmname">TotalControllerEvents</samp>
          </td>

          <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d70742e84 ">The number of times controllers were triggered.</td>

        </tr>
        <tr class="">
          <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d70742e81 ">
            <samp class="parmname">UserAgent</samp>
          </td>

          <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d70742e84 ">
            <p>User Agent for this event. For
              example:</p>
            <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code class="nolang">Mozilla/5.0 (Macintosh; Intel Mac OS X 11_2_1 ) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 </code></pre>
          </td>

        </tr>
      </tbody>
    </table>

See the [API Documentation](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_guestuseranomalyevent.htm) for a full list of fields.

Now that you have the data, you can investigate further.