---
schema_version: "1"
id: dc2931f65d50bf5090e9c500660691060c6f0d80577a47c8b73482334ca66f30
title: Report Anomaly
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/real_time_em_threat_reportanomaly.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_reportanomaly.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 1a6010c1a363e79440c8d1333ef8124222d492c11605cd29441d15310c84c4a8
description: An anomaly is any user activity that is sufficiently different from the historical activity of the same user. We use the metadata in Salesforce Core application logs about report generation and surrounding activities to build a baseline model of the historical activity. We then compare any new report generation activity against this baseline to determine if the new activity is sufficiently different to be called an anomaly. We don't look at the actual data that a user interacts with— we look at how the user interacts with the data.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# Report Anomaly

An _anomaly_ is any user activity that is sufficiently different from the historical activity of the same user. We use the metadata in Salesforce Core application logs about report generation and surrounding activities to build a baseline model of the historical activity. We then compare any new report generation activity against this baseline to determine if the new activity is sufficiently different to be called an anomaly. We don't look at the actual data that a user interacts with— we look at _how_ the user interacts with the data.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in both Salesforce Classic (not available in all orgs) and Lightning
            Experience.</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
              Editions</p>
            <p style="margin-bottom:0;">Requires Salesforce Shield or Salesforce Event Monitoring add-on
              subscriptions.</p>
          </td>

        </tr>
      </tbody>
    </table>

- **[Training and Inference Steps](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_steps.htm&release=264.0.0&type=5)**  
    Similar to other machine learning or statistical models, our detection model has a familiar two-step process: a training step and an inference or detection step. As a customer, you don't perform either of these steps—Salesforce performs them for you. You only review the detection events generated by our detection mode and take further action if necessary.
- **[Investigate Report Anomalies](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_review.htm&release=264.0.0&type=5)**  
    It's often necessary to further investigate a report anomaly to either rule it out as benign or to determine if a data breach occurred.
- **[Best Practices for Investigating Report Anomalies](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_bestpractices.htm&release=264.0.0&type=5)**  
    Keep these tips and best practices in mind when you investigate unusual user behavior. They can help you find the information you require to make a well informed conclusion about your data’s safety.
- **[Report Anomaly Detection Examples](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_examples.htm&release=264.0.0&type=5)**  
    Here are several examples that illustrate how you can investigate anomalous report events thoroughly.