SessionHijackingEventStore (Beta)

Tracks when unauthorized users gain ownership of a Salesforce user’s session with a stolen session identifier. To detect such an event, Salesforce evaluates how significantly a user’s current browser fingerprint diverges from the previously known fingerprint using a probabilistically inferred significance of change. SessionHijackingEventStore is an object that stores the event data of SessionHijackingEvent. This object is available in API version 48.0 and later.

Supported Calls

As a beta feature, the SessionHijackingEventStore event is a preview and not part of the “Services” under your master subscription agreement with Salesforce. Use this feature at your sole discretion, and make your purchase decisions only on the basis of generally available products and features. Salesforce doesn’t guarantee general availability of this feature within any particular time frame or at all, and we can discontinue it at any time. This feature is for evaluation purposes only, not for production use. It’s offered as is and isn’t supported, and Salesforce has no liability for any harm or damage arising out of or in connection with it. All restrictions, Salesforce reservation of rights, obligations concerning the Services, and terms for related Non-Salesforce Applications and Content apply equally to your use of this feature. You can provide feedback and suggestions for this feature in the Salesforce Official: Shield group in the Trailblazer Community.

Note

describeSObjects(), getDeleted(), getUpdated(), query()

Special Access Rules

Accessing this object requires either the Salesforce Shield or Event Monitoring add-on subscription and the View Data Leakage Detection Events user permission.

Fields

Field	Details
CurrentIp	Type string Properties Filter, Group, Nillable, Sort Description The IP address of the newly observed fingerprint that deviates from the previous fingerprint. The difference between the current and previous values is one indicator that a session hijacking attack has occurred. See the PreviousIp field for the previous IP address. For example, `126.7.4.2.`
CurrentPlatform	Type string Properties Filter, Group, Nillable, Sort Description The platform of the newly observed fingerprint that deviates from the previous fingerprint. The difference between the current and previous values is one indicator that a session hijacking attack has occurred. See the PreviousPlatform field for the previous platform. For example, `MacIntel` or `Win32`.
CurrentScreen	Type string Properties Filter, Group, Nillable, Sort Description The screen of the newly observed fingerprint that deviates from the previous fingerprint. The difference between the current and previous values is one indicator that a session hijacking attack has occurred. See the PreviousScreen field for the previous screen. For example, (`900.0,1440.0)` or `(720,1280)`.
CurrentUserAgent	Type string Properties Filter, Nillable, Sort Description The user agent of the newly observed fingerprint that deviates from the previous fingerprint. The difference between the current and previous values is one indicator that a session hijacking attack has occurred. See the PreviousUserAgent field for the previous user agent. For example, `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36`.
CurrentWindow	Type string Properties Filter, Group, Nillable, Sort Description The browser window of the newly observed fingerprint that deviates from the previous fingerprint. The difference between the current and previous values is one indicator that a session hijacking attack has occurred. See the PreviousWindow field for the previous window. For example, `(1200.0,1920.0)`.
EventDate	Type dateTime Properties Filter, Sort Description Required. The time when the anomaly was detected. For example, `2020-01-20T19:12:26.965Z`. Milliseconds are the most granular setting.
EventIdentifier	Type string Properties Filter, Group, Sort Description Required. The unique ID of the event. For example, `0a4779b0-0da1-4619-a373-0a36991dff90`.
LoginKey	Type string Properties Filter, Group, Nillable, Sort Description The string that ties together all events in a given user’s login session. The session starts with a login event and ends with either a logout event or the user session expiring. For example, lUqjLPQTWRdvRG4.
PreviousIp	Type string Properties Filter, Group, Nillable, Sort Description The IP address of the previous fingerprint. The IP address of the newly observed fingerprint deviates from this value. The difference between the current and previous values is one indicator that a session hijacking attack has occurred. See the CurrentIp field for the newly observed IP address. For example, `128.7.5.2`.
PreviousPlatform	Type string Properties Filter, Group, Nillable, Sort Description The platform of the previous fingerprint. The platform of the newly observed fingerprint deviates from this value. The difference between the current and previous values is one indicator that a session hijacking attack has occurred. See the CurrentPlatform field for the newly observed platform. For example, `Win32` or `iPhone`.
PreviousScreen	Type string Properties Filter, Group, Nillable, Sort Description The screen of the previous fingerprint. The screen of the newly observed fingerprint deviates from this value. The difference between the current and previous values is one indicator that a session hijacking attack has occurred. See the CurrentScreen field for the newly observed screen. For example, `(1200.0,1920.0)`.
PreviousUserAgent	Type string Properties Filter, Nillable, Sort Description The user agent of the previous fingerprint. The user agent of the newly observed fingerprint deviates from this value. The difference between the current and previous values is one indicator that a session hijacking attack has occurred. See the CurrentUserAgent field for the newly observed user agent. For example, `Mozilla/5.0 (iPhone; CPU iPhone OS 13_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko)`.
PreviousWindow	Type string Properties Filter, Group, Nillable, Sort Description The browser window of the previous fingerprint. The window of the newly observed fingerprint deviates from this value. The difference between the current and previous values is one indicator that a session hijacking attack has occurred. See the CurrentWindow field for the newly observed window. For example, `(1600.0,1920.0)`.
Score	Type double Properties Filter, Nillable, Sort Description Specifies how significant the new browser fingerprint deviates from the previous one. The score is a number from 6.0 through 21.0. The event exposes five Current-Previous field pairs (such as CurrentIp and PreviousIp) to view the before and after data for the five most interesting browser features that contributed to this anomaly detection. Salesforce detects session hijacking by comparing browser fingerprints in a given user session and evaluating how significantly a newly observed fingerprint deviates from the existing one. A large deviation score (6.0 or more) between two intra-session fingerprints indicates that two different browsers are active in the same session, which usually means that session hijacking has occurred.
SessionKey	Type string Properties Filter, Group, Nillable, Sort Description The user’s unique session ID. Use this value to identify all user events within a session. When a user logs out and logs in again, a new session is started. For example, vMASKIU6AxEr+Op5.
SourceIp	Type string Properties Filter, Group, Nillable, Sort Description The source IP address of the client that logged in. For example, `126.7.4.2`.
UserId	Type reference Properties Filter, Group, Nillable, Sort Description The origin user’s unique ID. For example, `005000000000123`.
Username	Type string Properties Filter, Group, Nillable, Sort Description The origin username in the format of `user@company.com` at the time the event was created.

Platform Events Developer Guide

SessionHijackingEventStore (Beta)

Supported Calls

Special Access Rules

Fields