---
schema_version: "1"
id: ab58fa423cb362175f4b6f41452e3030372e4665ce6d577e2828cbf3388da9ac
title: Detection Event Possibly Anomalous
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/real_time_em_threat_examples_maybeanomalous.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_examples_maybeanomalous.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: d79e78caf035703a93ba205c8ed1c7f9105e6cddea5001161848235f4e2849cd
description: Rob recently joined the company as a customer success representative. On Jan 15, 2019, Rob’s account was used to generate a report. Tony, the org’s Salesforce admin, noticed a ReportAnomalyEvent about this report generation activity.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# Detection Event Possibly Anomalous

Rob recently joined the company as a customer success representative. On Jan 15, 2019, Rob’s account was used to generate a report. Tony, the org’s Salesforce admin, noticed a ReportAnomalyEvent about this report generation activity.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in both Salesforce Classic (not available in all orgs) and Lightning
            Experience.</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
              Editions</p>
            <p style="margin-bottom:0;">Requires Salesforce Shield or Salesforce Event Monitoring add-on
              subscriptions.</p>
          </td>

        </tr>
      </tbody>
    </table>

The event contained this information.

 
| ReportAnomalyEvent Field | Value |
| --- | --- |
| Score | 96.4512 |
| SourceIp | 96.43.144.28 |
| EventDate | 2019-01-15T07:45:07.192Z |
| UserId | 00530000009M945 |
| Report | 00OD0000001leVCMAY |
| SecurityEventData | (see next table) |

The SecurityEventData field contained this information.

  
| featureName | featureValue | featureContribution |
| --- | --- | --- |
| rowCount | 46008 | 58.65% |
| userAgent | \- | 30.23% |
| averageRowSize | 1534 | 6.58% |
| browserCodecs | \- | 2.33% |
| acceptedLanguages | \- | 2.19% |

Tony notices that the rowCount feature is a bit high for their org. The second-ranking feature is userAgent with a feature contribution of around 30%. This percentage indicates that this user agent is not common for their org. Tony investigates further and finds Rob with the UserId field. Tony notices that Rob is a relatively new employee. By looking at the ReportEvent events, Tony notices that Rob occasionally generates reports of 46k rows. Because Rob is a relatively new employee, Tony can’t be certain whether this report matches Rob’s typical activity pattern.

Tony concludes that this detection is possibly nomalous, although he doesn’t take any threat mitigation actions now.

#### See Also

- [_Platform Events Developer Guide_: ReportAnomalyEvent](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_reportanomalyevent.htm)
- [_Platform Events Developer Guide_: ReportEvent](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_reportevent.htm)