--- schema_version: "1" id: 3169bd8973fbcabe47083c82798d0e950a641eda55960941608b05300e611998 title: Insecure External Assets Event Type collection: legacydeveloper version: current locale: en-us portal_url: https://docs.salesforce.com/legacydeveloper/current/en-us/object_reference/sforce_api_objects_eventlogfile_insecureexternalassets.md canonical_url: https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile_insecureexternalassets.htm source_site: developer.salesforce.com content_type: documentation content_hash: 137adaa8d4627280b62585a9ab4a9cd9ba265be67e97a06da5bdc58b88d5bebf description: Insecure External Assets events contain information about external assets. External assets include images or videos accessed by users over an insecure HTTP protocol. The event lists all your Salesforce pages that contain assets hosted insecurely on third-party sites that users loaded with a Chrome, Firefox, Microsoft Edge, or Safari browser. The INSECURE_URI field contains the URI being used to load the asset insecurely. The Insecure External Assets event type is available in the EventLogFile object in API version 42.0 and later. --- # Insecure External Assets Event Type Insecure External Assets events contain information about external assets. External assets include images or videos accessed by users over an insecure HTTP protocol. The event lists all your Salesforce pages that contain assets hosted insecurely on third-party sites that users loaded with a Chrome, Firefox, Microsoft Edge, or Safari browser. The INSECURE\_URI field contains the URI being used to load the asset insecurely. The Insecure External Assets event type is available in the EventLogFile object in API version 42.0 and later. Assets over HTTP can be manipulated through man-in-the-middle and other types of attacks. These attacks can trick users into sending their Salesforce credentials to malicious sites. Always use HTTPS in your custom code and templates for any asset you’re loading from external sites. ![Important](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/images/icon_note_important.png) #### Important Because HTTPS connections are required to load external assets, Insecure External Assets events no longer apply. In Spring ’25 and later, this event type captures no data. To view blocked redirections and content security policy (CSP) violations for your org, use the [BrowserPolicyViolation](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_browserpolicyviolation.htm "Represents a violation that occurred within the last seven days related to the Trusted URLs and Trusted URLs for External Redirects allowlists. These violations include blocked resource requests based on your content security policy (CSP) and blocked redirections. This object is available in API version 61.0 and later.") object. For details about event monitoring, see the [Trailhead Event Monitoring module](https://trailhead.salesforce.com/en/modules/event_monitoring/units/event_monitoring_intro "HTML (New Window)") or the [REST API Developer’s Guide](https://developer.salesforce.com/docs/atlas.en-us.264.0.api_rest.meta/api_rest/using_resources_event_log_files.htm "HTML (New Window)"). ## Fields | Field | Details | | --- | --- | | ASSET\_TYPE | Type String Description Type of insecure asset. Possible Values - Base URI - Connect - Font - Frame Ancestor: External page that embeds the Salesforce page in an iframe - Frame - Image - Media - Object - Other - Plugin Types - Script - Style | | CLIENT\_IP | Type String Description The IP address of the client that’s using Salesforce services. A Salesforce internal IP (such as a login from AppExchange) is shown as “Salesforce.com IP”. For example: 96.43.144.26. | | CPU\_TIME | Type Number Description The CPU time in milliseconds used to complete the request. This field indicates the amount of activity taking place in the app server layer. | | DISPOSITION | Type String Description If the insecure external asset is related to your content security policy (CSP), the HTTP header that identified the insecure asset. Available in API version 61.0 and later. Possible Values - enforce—The Content-Security-Policy header identified the insecure external asset. - report—The Content-Security-Policy-Report-Only header identified the insecure external asset. | | DOCUMENT\_URI | Type String Description URL of the page that contains the insecure asset, excluding the query parameter. Example https://company.my.salesforce.com/00XXXXXXXXX | | EVENT\_TYPE | Type String Description The type of event. The value is always InsecureExternalAssets. | | INSECURE\_URI | Type String Description Insecure external asset URL being used to load an asset insecurely. For example, loading Javascript libraries using **http:**//ajax.googleapis.com/  in your custom code logs an Insecure External Asset Event with the INSECURE\_URI  field set to this URL. Find this reference in your code and update it to use **https:**//ajax.googleapis.com/  instead. Example http://pbs.twimg.com/profile\_images/5699091412070816/Z4Stwts\_normal.jpeg | | LOGIN\_KEY | Type String Description The string that ties together all events in a given user’s login session. It starts with a login event and ends with either a logout event or the user session expiring. For example: GeJCsym5eyvtEK2I. | | NETWORK\_ID | Type String Description The ID of the Experience Cloud site related to the request, if applicable. Available in API version 61.0 and later. | | ORGANIZATION\_ID | Type String Description The 15-character ID of the org. Example 00D000000000123 | | REQUEST\_ID | Type String Description The unique ID of a single transaction. A transaction can contain one or more events. Each event in a given transaction has the same REQUEST\_ID. For example: 3nWgxWbDKWWDIk0FKfF5DV. | | RUN\_TIME | Type Number Description The amount of time that the request took in milliseconds. | | SESSION\_KEY | Type String Description The user’s unique session ID. You can use this value to identify all user events within a session. When a user logs out and logs in again, a new session is started. For example: d7DEq/ANa7nNZZVD. | | TIMESTAMP | Type String Description The access time of Salesforce services in GMT. For example: 20130715233322.670. | | TIMESTAMP\_DERIVED | Type DateTime Description The access time of Salesforce services in ISO8601-compatible format (YYYY-MM-DDTHH:MM:SS.sssZ). For example: 2015-07-27T11:32:59.555Z. Timezone is GMT. | | TYPE | Type String Description Type of Salesforce page. Possible Values - Appserver—Page without My Domain subdomain (for example, https://na44.salesforce.com) - Communities—Customer Experience Cloud site - Email—Email preview - Login—Login page (for example, https://login.salesforce.com) - Mydomain—Page on My Domain subdomain (for example, https://mycompany.my.salesforce.com) - Sites—Customer site - Static—Static content (for example, https://sfdcstatic.com) - Unknown—other type of page | | UNIQUE\_ID | Type String Description The 32-character ID of the event log file in which the insecure external asset event data is found. Example 44e128a5-ac7a-4c9a-be4c-224b6bf81b20 | | URI | Type String Description The URI of the page that’s receiving the request. For example: /home/home.jsp. | | URI\_ID\_DERIVED | Type ID Description The 18-character case insensitive ID of the URI of the page that’s receiving the request. | | USER\_ID | Type Id Description The 15-character ID of the user who’s using Salesforce services through the UI or the API. For example: 00530000009M943 | | USER\_ID\_DERIVED | Type Id Description The 18-character case insensitive ID of the user who’s using Salesforce services through the UI or the API. For example: 00590000000I1SNIA0. | ## Usage UNIQUE\_ID is used by Salesforce Customer Support to troubleshoot any issues that occur. #### See Also - [EventLogFile Supported Event Types](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile_supportedeventtypes.htm "The EventType field in the EventLogFile object supports these events. Some common fields, such as CPU_TIME and RUN_TIME, can have null or zero values depending on how the events are generated for a given feature. Sometimes, three quotation marks appear around event data containing special characters in the CSV file. The third quotation mark is necessary for tools and applications to parse the field data at the correct field value boundary.") - [EventLogFile](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile.htm "Represents event log files generated by Event Monitoring. Use event log file data to analyze usage trends and user behavior in your Salesforce org. This object is available in API version 32.0 and later. The Interval and Sequence fields are available only in API version 37.0 and later.")