---
schema_version: "1"
id: 50485507c8a1196fb7d558b5cd7c154c1c486015365acb5086cf50d4b1123943
title: API Detection Event Isn’t Anomalous
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/real_time_em_threat_examples_api_notanomalous.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_examples_api_notanomalous.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 10903eb32e134c0e9d05b4399507ebf6d44ddccf18087c5b9c5470dcead5219b
description: Jason, a developer, uses APIs to query an Account object on a Sunday. He retrieves 10,000 records.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# API Detection Event Isn’t Anomalous

Jason, a developer, uses APIs to query an Account object on a Sunday. He retrieves 10,000 records.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in both Salesforce Classic (not available in all orgs) and Lightning
            Experience.</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
              Editions</p>
            <p style="margin-bottom:0;">Requires Salesforce Shield or Salesforce Event Monitoring add-on
              subscriptions.</p>
          </td>

        </tr>
      </tbody>
    </table>

The event contains this information.

 
| APIAnomalyEvent Field | Value |
| --- | --- |
| Score | .5801 |
| SourceIp | 96.43.144.30 |
| EventDate | 2020-03-27T07:45:07.192Z |
| UserId | 00530000009M946 |
| SecurityEventData | (see next table) |

The SecurityEventData field contains this information.

  
| featureName | featureValue | featureContribution |
| --- | --- | --- |
| rowCount | 1937568 | 95.00% |
| autonomousSystem | Bigleaf Networks, Inc. | 1.62% |
| dayOfWeek | Sunday | 1.42% |
| userAgent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36} | 1.21% |
| periodOfDay | Evening | 0.09% |
| averageRowSize | 744 | 0.08% |
| screenResolution | 900x1440 | 0.07% |

Alia, the Salesforce admin, notices that 10,000 records were retrieved from an Account object on a Sunday. She investigates further. Using the UserId field value, Alia identifies Jason as the user. She then looks through Jason’s past activity. She notices that Jason, a developer, retrieves records of varying amounts, ranging from just a handful to 20,000 records. Alia also notices in the dayOfWeek and periodOfDay features that Jason often works Sundays and nights.

Alia concludes that this detection event wasn’t anomalous because the activity is well within Jason's typical activity.

#### See Also

- [_Platform Events Developer Guide_: ApiAnomalyEvent](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_apianomalyevent.htm?q=API%20Anomaly)
- [_Platform Events Developer Guide_: ApiEvent](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_apievent.htm)