---
schema_version: "1"
id: d1d5f3c181b3d294264e959aca583f5b937feec89a2ff3e0bf19ff635701a1e7
title: Detection Event Isn’t Anomalous
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/real_time_em_threat_examples_notanomalous.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_examples_notanomalous.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 416f7c5a93324aed962ddecdbe8652d615ffac6721588d44ae017ecbebccfa67
description: Jason is a sales data analyst who reports to the regional sales manager. It’s Jason’s job to generate reports for his manager’s sales calls. On March 27, 2019, Jason’s account was used to generate a report. Alia, the administrator for Jason’s org, noticed a ReportAnomalyEvent about this report generation activity.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# Detection Event Isn’t Anomalous

Jason is a sales data analyst who reports to the regional sales manager. It’s Jason’s job to generate reports for his manager’s sales calls. On March 27, 2019, Jason’s account was used to generate a report. Alia, the administrator for Jason’s org, noticed a ReportAnomalyEvent about this report generation activity.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in both Salesforce Classic (not available in all orgs) and Lightning
            Experience.</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
              Editions</p>
            <p style="margin-bottom:0;">Requires Salesforce Shield or Salesforce Event Monitoring add-on
              subscriptions.</p>
          </td>

        </tr>
      </tbody>
    </table>

The event contained this information.

 
| ReportAnomalyEvent Field | Value |
| --- | --- |
| Score | 0.9 |
| SourceIp | 96.43.144.30 |
| EventDate | 2019-03-27T07:45:07.192Z |
| UserId | 00530000009M946 |
| Report | 00OD0000001leVCMAY |
| SecurityEventData | (see next table) |

The SecurityEventData field contained this information.

  
| featureName | featureValue | featureContribution |
| --- | --- | --- |
| rowCount | 17234 | 60.2% |
| dayOfWeek | 0 | 25.6% |
| numberColumns | 12 | 12.5% |
| numberFilters | 11 | 1.04% |
| periodOfDay | Night | 0.65% |

Alia notices that this report had approximately 17k rows generated on a Sunday. She decides to investigate further. Using the UserId field value, Alia identifies Jason as the user. She then looks through Jason’s past report generation activity using the ReportEvent event. She notices that Jason, a sales data analyst, generates reports of varying sizes, ranging from just a handful of rows to 20k rows. Alia also notices that Jason often accompanies his manager on road shows, which often involves working Sundays and nights.

Alia concludes that this detection event wasn’t anomalous because the report generation activity is well within Jason's typical activity.

#### See Also

- [_Platform Events Developer Guide_: ReportAnomalyEvent](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_reportanomalyevent.htm)
- [_Platform Events Developer Guide_: ReportEvent](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_reportevent.htm)