An anomaly is any user activity that is sufficiently different from the
historical activity of the same user. We use the metadata in Salesforce Core application logs
about report generation and surrounding activities to build a baseline model of the historical
activity. We then compare any new report generation activity against this baseline to determine
if the new activity is sufficiently different to be called an anomaly. We don't look at the
actual data that a user interacts with— we look at how the user interacts with the
data.
Required Editions
| Available in both Salesforce Classic (not available in all orgs) and Lightning
Experience. |
|
Available in: Enterprise, Unlimited, and Developer
Editions
Requires Salesforce Shield or Salesforce Event Monitoring add-on
subscriptions.
|
- Training and Inference Steps
Similar to other machine learning or statistical models, our detection model has a familiar two-step process: a training step and an inference or detection step. As a customer, you don't perform either of these steps—Salesforce performs them for you. You only review the detection events generated by our detection mode and take further action if necessary.
- Investigate Report Anomalies
It's often necessary to further investigate a report anomaly to either rule it out as benign or to determine if a data breach occurred.
- Best Practices for Investigating Report Anomalies
Keep these tips and best practices in mind when you investigate unusual user behavior. They can help you find the information you require to make a well informed conclusion about your data’s safety.
- Report Anomaly Detection Examples
Here are several examples that illustrate how you can investigate anomalous report events thoroughly.
