---
schema_version: "1"
id: f63dc340d5ef5d5bf050e19affdb162fac6083f54a3524e038a7c374e249f0ed
title: API Detection Event Is an Anomaly but Isn’t Clearly Malicious
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/real_time_em_threat_examples_api_anomalous.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_examples_api_anomalous.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 79e80745523705dc752488547d0d4ca9a5b4dbb7159a5ed1b5044b3959efb59b
description: Alice is a sales rep based in St. Louis. She’s often on the road to meet with clients. When she travels, she generally, but not consistently, uses her company’s VPN to log into Salesforce.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# API Detection Event Is an Anomaly but Isn’t Clearly Malicious

Alice is a sales rep based in St. Louis. She’s often on the road to meet with clients. When she travels, she generally, but not consistently, uses her company’s VPN to log into Salesforce.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in both Salesforce Classic (not available in all orgs) and Lightning
            Experience.</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
              Editions</p>
            <p style="margin-bottom:0;">Requires Salesforce Shield or Salesforce Event Monitoring add-on
              subscriptions.</p>
          </td>

        </tr>
      </tbody>
    </table>

On July 27, 2020, Alice’s account was used to query an object from a relatively new IP address. Bob, the administrator for Alice’s Salesforce org, noticed a APIAnomalyEvent about this report generation activity. The event contained this information.

 
| APIAnomalyEvent Field | Value |
| --- | --- |
| Score | .8671 |
| SourceIp | 96.43.144.27 |
| EventDate | 2015-07-27T07:45:07.192Z |
| UserId | 00530000009M944 |
| SecurityEventData | (see next table) |

The SecurityEventData field contains this information.

  
| featureName | featureValue | featureContribution |
| --- | --- | --- |
| rowCount | 50568 | 95.00% |
| autonomousSystem | Bigleaf Networks, Inc. | 73.4% |
| dayOfWeek | Sunday | 1.42% |
| userAgent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36} | 29.21% |
| periodOfDay | Evening | 0.09% |
| averageRowSize | 744 | 0.08% |
| screenResolution | 900x1440 | 0.07% |

Bob, the Salesforce admin, notices that the autonomous system—derived from the IP address—is the top-ranked feature with 73.4% feature contribution. This percentage indicates that Alice rarely uses this autonomous system. Bob also notices that the rowCount has around 50,000 rows, which isn’t small for this org. Bob then uses the UserId to identify the user as Alice. By looking at the <need event name here> events, Bob notices that Alice typically generates reports containing 1,000–10,000 rows. But on rare occasions, Alice generated reports with more than 50,000 rows. The userAgent has a smaller feature contribution, which could be attributed to Alice using her mobile device less when she travels. The numberFilters and periodOfDay features have small feature contributions, and are therefore not important.

Because Alice rarely uses this autonomous system and the report is larger than reports Alice typically generates, Bob concludes that this report falls outside of typical activity. But Bob is unable to verify whether Alice or an attacker committed this malicious act. He attempts to get more information on this incident.

#### See Also

- [_Platform Events Developer Guide_: ApiAnomalyEvent](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_apianomalyevent.htm?q=API%20Anomaly)
- [_Platform Events Developer Guide_: ApiEvent](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_apievent.htm)