---
schema_version: "1"
id: e4cf22d9dca00fa2920fc9a5d1886960392567e7250b32a7feee84939b704f36
title: ThreatDetectionFeedback
collection: legacydeveloper
version: current
locale: en-us
portal_url: https://docs.salesforce.com/legacydeveloper/current/en-us/object_reference/sforce_api_objects_threatdetectionfeedback.md
canonical_url: https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_threatdetectionfeedback.htm
source_site: developer.salesforce.com
content_type: documentation
content_hash: 3391f3fd5847d227c3d1b43f02030e73dd362982617c369441cf7e51a21e7d85
description: "Represents feedback provided by a user about a Threat Detection event that occurred in your org. The feedback specifies whether the event was malicious, suspicious, not a threat, or unknown. Each ThreatDetectionFeedback object is associated with one of these Threat Detection storage events: ApiAnomalyEventStore, CredentialStuffingEventStore, ReportAnomalyEventStore, or SessionHijackingEventStore. This object is available in API version 49.0 and later."
---
# ThreatDetectionFeedback

Represents feedback provided by a user about a Threat Detection event that occurred in your org. The feedback specifies whether the event was malicious, suspicious, not a threat, or unknown. Each ThreatDetectionFeedback object is associated with one of these Threat Detection storage events: ApiAnomalyEventStore, CredentialStuffingEventStore, ReportAnomalyEventStore, or SessionHijackingEventStore. This object is available in API version 49.0 and later.

## Supported Calls

create(), describeLayout(), describeSObjects(), getDeleted(), getUpdated(), query(), update(), upsert()

## Fields

| Field | Details |
| --- | --- |
| LastReferencedDate | 
Type

dateTime

Properties

Filter, Nillable, Sort

Description

The timestamp for when the current user last viewed a record related to this record.



 |
| LastViewedDate | 

Type

dateTime

Properties

Filter, Nillable, Sort

Description

The timestamp for when the current user last viewed this record. If this value is null, it’s possible that this record was referenced (LastReferencedDate) and not viewed.



 |
| Response | 

Type

picklist

Properties

Create, Filter, Group, Restricted picklist, Sort, Update

Description

Describes the severity of the threat.

Possible values are:

- Malicious
- Not a Threat
- Suspicious
- Unknown





 |
| ThreatDetectionEventId | 

Type

reference

Properties

Create, Filter, Group, Nillable, Sort, Update

Description

Reference to the unique ID of one of these associated Threat Detection storage events:

- [ApiAnomalyEventStore](https://developer.salesforce.com/docs/atlas.en-us.264.0.platform_events.meta/platform_events/sforce_api_objects_apianomalyeventstore.htm)
- [CredentialStuffingEventStore](https://developer.salesforce.com/docs/atlas.en-us.264.0.platform_events.meta/platform_events/sforce_api_objects_credentialstuffingeventstore.htm)
- [ReportAnomalyEventStore](https://developer.salesforce.com/docs/atlas.en-us.264.0.platform_events.meta/platform_events/sforce_api_objects_reportanomalyeventstore.htm)
- [SessionHijackingEventStore](https://developer.salesforce.com/docs/atlas.en-us.264.0.platform_events.meta/platform_events/sforce_api_objects_sessionhijackingeventstore.htm)

For example, 0fjRM000000005p.

This is a polymorphic relationship field.

Relationship Name

ThreatDetectionEvent

Refers To

ApiAnomalyEventStore, CredentialStuffingEventStore, GuestUserAnomalyEventStore, LoginAnomalyEventStore, ReportAnomalyEventStore, SessionHijackingEventStore, UniversalAnomalyEventStore



 |
| ThreatDetectionFeedbackNumber | 

Type

string

Properties

Autonumber, Defaulted on create, Filter, idLookup, Sort

Description

Auto-generated number used as the unique name for this object.



 |
| UserId | 

Type

reference

Properties

Create, Filter, Group, Nillable, Sort, Update

Description

The origin user’s unique ID. For example, 005000000000123.

This is a polymorphic relationship field.

Relationship Name

User

Relationship Type

Lookup

Refers To

User



 |
| Username | 

Type

string

Properties

Create, Filter, Group, Nillable, Sort, Update

Description

The origin username in the format of user@company.com at the time the object was created.



 |

## Associated Object

This object has the following associated object. It’s available in the same API version as this object.

[ThreatDetectionFeedbackFeed](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_associated_objects_feed.htm "StandardObjectNameFeed is the model for all feed objects associated with standard objects. These objects represent the posts and feed-tracked changes of a standard object.")

Feed tracking is available for the object.

#### See Also

- [_Salesforce Help_: Threat Detection](https://help.salesforce.com/articleView?id=real_time_em_threat_detection.htm&type=5&language=en_US "
    Salesforce Help: Threat Detection - HTML (New Window)")