--- schema_version: "1" id: e1c49eef7f42e0af436ca70e1376b682ac481a1320717a211fbc4417a7d11a6a title: TenantSecurityCredentialStuffing collection: legacydeveloper version: current locale: en-us portal_url: https://docs.salesforce.com/legacydeveloper/current/en-us/object_reference/sforce_api_objects_tenantsecuritycredentialstuffing.md canonical_url: https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_tenantsecuritycredentialstuffing.htm source_site: developer.salesforce.com content_type: documentation content_hash: d15600c892f2821e0f86fd64863a717c88ee5faaff61e78807f5cb3485bd4334 description: Stores when a user successfully logs in to Salesforce during an identified credential stuffing attack. For more information, see Threat Detection. This object is available to Security Center subscribers in API version 53.0 and later. --- # TenantSecurityCredentialStuffing Stores when a user successfully logs in to Salesforce during an identified credential stuffing attack. For more information, see [Threat Detection](https://help.salesforce.com/s/articleView?language=en_US&type=5&id=sf.real_time_em_threat_detection.htm). This object is available to Security Center subscribers in API version 53.0 and later. ![Note](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/images/icon_note.png) #### Note Threat Detection is available only for Event Monitoring subscribers. ## Supported Calls describeSObjects(), getDeleted(), getUpdated(), query(), retrieve() ## Special Access Rules This object is read-only. ## Fields | Field | Details | | --- | --- | | AcceptLanguage | Type string Properties Filter, Group, Nillable, Sort Description List of HTTP headers that specify the natural language, such as English, that the client understands. | | DetailIdentifier | Type string Properties Filter, Group, idLookup, Sort Description The ID of the individual detail record. This field is unique within your org. | | EventDate | Type dateTime Properties Filter, Nillable, Sort Description The date when the hijacking event was reported. For example, 2020-01-20T19:12:26.965Z. Milliseconds are the most granular setting. | | EventIdentifier | Type string Properties Filter, Group, idLookup, Nillable, Sort Description The unique ID of the event. | | EventName | Type string Properties Filter, Group, idLookup, Nillable, Sort Description The name of the event, which is Credential Stuffing. | | LoginType | Type string Properties Filter, Group, Nillable, Sort Description The type of login used to access the session. For the list of possible values, see the LoginType field of [LoginHistory](https://developer.salesforce.com/docs/atlas.en-us.264.0.object_reference.meta/object_reference/sforce_api_objects_loginhistory.htm) in the Object Reference. | | LoginUrl | Type string Properties Filter, Group, Nillable, Sort Description The URL of the login page. For example, login.salesforce.com. | | MetricIdentifier | Type string Properties Filter, Group, Sort Description The ID of the type of metric that was counted. | | MetricsType | Type picklist Properties Filter, Group, Restricted picklist, Sort Description The type of data collected. | | Name | Type string Properties Filter, Group, idLookup, Sort Description The name of the metric for the data collected. | | Score | Type double Properties Filter, idLookup, Nillable, Sort Description Indicates that a user successfully logged in to Salesforce during an identified credential stuffing attack. The value of this field is always 1. | | Summary | Type textarea Properties Nillable Description A summary of the threat that caused this event to be created. | | Tenant | Type string Properties Filter, Group, idLookup, Sort Description The ID of the tenant that was targeted in the event. | | TenantName | Type string Properties Filter, Group, idLookup, Nillable, Sort Description The name of the tenant that was targeted in the event. | | UserAgent | Type textarea Properties Nillable Description UserAgent used in the HTTP request, post-processed by the server. | | UserIdentifier | Type string Properties Filter, Group, Nillable, Sort Description The origin user’s unique ID. | | Username | Type string Properties Filter, Group, idLookup, Nillable, Sort Description The origin username in the format of user@company.com at the time the event was created. | ## Associated Objects This object has these associated objects. If the API version isn’t specified, it’s available in the same API versions as this object. Otherwise, it’s available in the specified API version and later. [TenantSecurityCredentialStuffingChangeEvent](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_associated_objects_change_event.htm "A ChangeEvent object is available for each object that supports Change Data Capture. You can subscribe to a stream of change events using Change Data Capture to receive data tied to record changes in Salesforce. Changes include record creation, updates to an existing record, deletion of a record, and undeletion of a record. A change event isn’t a Salesforce object—it doesn’t support CRUD operations or queries. It’s included in the object reference so you can discover which Salesforce objects support change events.") Change events are available for the object. [TenantSecurityCredentialStuffingFeed](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_associated_objects_feed.htm "StandardObjectNameFeed is the model for all feed objects associated with standard objects. These objects represent the posts and feed-tracked changes of a standard object.") Feed tracking is available for the object. [TenantSecurityCredentialStuffingHistory](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_associated_objects_history.htm "StandardObjectNameHistory is the model for all history objects associated with standard objects. These objects represent the history of changes to the values in the fields of a standard object.") History is available for tracked fields of the object. [TenantSecurityCredentialStuffingOwnerSharingRule](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_associated_objects_ownersharingrule.htm "StandardObjectNameOwnerSharingRule is the model for all owner sharing rule objects associated with standard objects. These objects represent a rule for sharing a standard object with users other than the owner.") Sharing rules are available for the object. [TenantSecurityCredentialStuffingShare](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_associated_objects_share.htm "StandardObjectNameShare is the model for all share objects associated with standard objects. These objects represent a sharing entry on the standard object.") Sharing is available for the object.