--- schema_version: "1" id: 7e85c932059cddb29f7d6c04c8561c31c8a5343ffe19b180a37c8e95cd5f625d title: TenantSecurityGuestUserAnomaly collection: legacydeveloper version: current locale: en-us portal_url: https://docs.salesforce.com/legacydeveloper/current/en-us/object_reference/sforce_api_objects_tenantsecurityguestuseranomaly.md canonical_url: https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_tenantsecurityguestuseranomaly.htm source_site: developer.salesforce.com content_type: documentation content_hash: b6d22bbf4a39f9fd34df8fbde83da83e9c3e00942ae0d47a3400b8c7b1fa4007 description: Represents metric details for guest user anomaly events detected by Threat Detection. This object is available in API version 60.0 and later. --- # TenantSecurityGuestUserAnomaly Represents metric details for guest user anomaly events detected by Threat Detection. This object is available in API version 60.0 and later. ## Supported Calls create(), delete(), describeSObjects(), getDeleted(), getUpdated(), query(), retrieve(), undelete(), update(), upsert() ## Special Access Rules This object is read-only. ## Fields | Field | Details | | --- | --- | | DetailIdentifier | Type string Properties Create, Filter, Group, idLookup, Sort, Update Description The unique identifier for this detail record. | | EventDate | Type dateTime Properties Create, Filter, Nillable, Sort, Update Description The time when the anomaly was reported. For example, 2020-01-20T19:12:26.965Z. The most granular setting is milliseconds. | | EventIdentifier | Type string Properties Create, Filter, Group, idLookup, Nillable, Sort, Update Description The unique ID of the event, which is shared with the corresponding storage object. | | EventName | Type string Properties Create, Filter, Group, idLookup, Nillable, Sort, Update Description The name of the event. | | MetricIdentifier | Type string Properties Create, Filter, Group, Sort, Update Description The ID of the type of metric counted. This field is unique within your organization. | | MetricsType | Type picklist Properties Create, Filter, Group, Restricted picklist, Sort, Update Description The type of data collected. | | Name | Type string Properties Create, Filter, Group, idLookup, Sort, Update Description The name of the metric for the data collected. | | RequestedObjects | Type textarea Properties Create, Nillable, Update Description The objects requested by the customers. | | Score | Type double Properties Create, Filter, idLookup, Nillable, Sort, Update Description Specifies how significantly the guest user behavior deviates from the other guest users. It is formatted as a number between 0 and 1. | | SoqlCommands | Type textarea Properties Create, Nillable, Update Description SOQL commands run by the guest user. | | Summary | Type textarea Properties Create, Nillable, Update Description A text summary of the anomaly that caused this event. | | Tenant | Type string Properties Create, Filter, Group, idLookup, Sort, Update Description The ID of the tenant that was targeted in the event. | | TenantName | Type string Properties Create, Filter, Group, idLookup, Nillable, Sort, Update Description The name of the tenant that was targeted in the event. | | TotalControllerEvents | Type string Properties Create, Filter, Group, Nillable, Sort, Update Description The number of times controllers were triggered. | | UserAgent | Type string Properties Create, Filter, Group, Nillable, Sort, Update Description User Agent for this event. | | UserIdentifier | Type string Properties Create, Filter, Group, Nillable, Sort, Update Description The origin user’s unique ID. | | UserType | Type string Properties Create, Filter, Group, Nillable, Sort, Update Description Type of user of this event. For example, a guest user. | | Username | Type string Properties Create, Filter, Group, idLookup, Nillable, Sort, Update Description The origin username in the format of user@company.com at the time the event was created. | ## Associated Objects This object has the following associated objects. If the API version isn’t specified, they’re available in the same API versions as this object. Otherwise, they’re available in the specified API version and later. [TenantSecurityGuestUserAnomalyChangeEvent](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_associated_objects_change_event.htm "A ChangeEvent object is available for each object that supports Change Data Capture. You can subscribe to a stream of change events using Change Data Capture to receive data tied to record changes in Salesforce. Changes include record creation, updates to an existing record, deletion of a record, and undeletion of a record. A change event isn’t a Salesforce object—it doesn’t support CRUD operations or queries. It’s included in the object reference so you can discover which Salesforce objects support change events.") Change events are available for the object. [TenantSecurityGuestUserAnomalyFeed](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_associated_objects_feed.htm "StandardObjectNameFeed is the model for all feed objects associated with standard objects. These objects represent the posts and feed-tracked changes of a standard object.") Feed tracking is available for the object. [TenantSecurityGuestUserAnomalyHistory](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_associated_objects_history.htm "StandardObjectNameHistory is the model for all history objects associated with standard objects. These objects represent the history of changes to the values in the fields of a standard object.") History is available for tracked fields of the object. [TenantSecurityGuestUserAnomalyOwnerSharingRule](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_associated_objects_ownersharingrule.htm "StandardObjectNameOwnerSharingRule is the model for all owner sharing rule objects associated with standard objects. These objects represent a rule for sharing a standard object with users other than the owner.") Sharing rules are available for the object. [TenantSecurityGuestUserAnomalyShare](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_associated_objects_share.htm "StandardObjectNameShare is the model for all share objects associated with standard objects. These objects represent a sharing entry on the standard object.") Sharing is available for the object.