Salesforce Security Guide

Salesforce Security Guide
Salesforce Security Basics
Authenticate Users
Give Users Access to Data
Share Objects and Fields
Strengthen Your Data's Security with Shield Platform Encryption
Monitoring Your Organization’s Security
Real-Time Event Monitoring
Real-Time Event Monitoring Definitions
Considerations for Using Real-Time Event Monitoring
Enable Access to the Real-Time Event Monitoring
Stream and Store Event Data
Create Logout Event Triggers
How Chunking Works with ReportEvent and ListViewEvent
Enhanced Transaction Security
Types of Enhanced Transaction Security Policies
Enhanced Transaction Security Actions and Notifications
Build a Transaction Security Policy with Condition Builder
Create an Enhanced Transaction Security Policy That Uses Apex
Best Practices for Writing and Maintaining Enhanced Transaction Security Policies
Enhanced Transaction Security Metering
Test and Troubleshoot Your New Enhanced Policy
Migrate Legacy Policies to the Enhanced Transaction Security Framework
Choose an Event for the Enhanced Policy
Choose Event Fields for the Enhanced Policy Conditions
Create a Policy with a UI or with Apex Code
Differences Between the Legacy and Enhanced Apex Interfaces
Policy Migration Examples
Simple Policy Migration Example
Lead Data Export Policy Migration Example
Advanced Policy Migration Example
Threat Detection
Security Guidelines for Apex and Visualforce Development
PDF

Newer Version Available

This content describes an older version of this product. View Latest

Advanced Policy Migration Example

This example shows how to migrate a more complex policy.
Available in: Salesforce Classic and Lightning Experience
Available in: Enterprise, Unlimited, and Developer Editions

Requires Salesforce Shield or Salesforce Event Monitoring add-on subscriptions.

The sample legacy policy in this topic is similar to the legacy Lead Data Export policy but with two key differences. Rather than monitor only leads, this policy monitors several different object types. Also, rather than hard-code an export limit of 2,000 records, this policy defines different limits for different object types.

The export limits are stored in a custom metadata type called TransactionSecurityLimit__mdt which contains these two fields:
  • Object_Type__c (Picklist)—The object type
  • Limit_Value__c (Number(18,0))—The maximum number of records of this object type that a user is allowed to export

The legacy policy queries this custom metadata type to dynamically determine the export limit value for each object type.

In the enhanced policy, we can reuse most of the logic that queries the TransactionSecurityLimit__mdt custom metadata type. The main difference is the code for getting the name of the entities for which we want to query the export limit. In the legacy policy, we use the EntityName key value of the data Map. Its equivalent in the enhanced framework is QueriedEntities. But remember that the QueriedEntities field can contain more than one entity name, because the enhanced framework supports exports on all standard and custom objects. So we take the comma-separated list of queried entities and split it up into a List of entity names.