Salesforce Security Guide

Salesforce Security Guide
Salesforce Security Basics
Authenticate Users
Give Users Access to Data
Share Objects and Fields
Strengthen Your Data's Security with Shield Platform Encryption
Monitoring Your Organization’s Security
Real-Time Event Monitoring
Real-Time Event Monitoring Definitions
Considerations for Using Real-Time Event Monitoring
Enable Access to Real-Time Event Monitoring
Stream and Store Event Data
Create Logout Event Triggers
How Chunking Works with ReportEvent and ListViewEvent
Enhanced Transaction Security
Types of Enhanced Transaction Security Policies
Enhanced Transaction Security Actions and Notifications
Build a Transaction Security Policy with Condition Builder
Create an Enhanced Transaction Security Policy That Uses Apex
Best Practices for Writing and Maintaining Enhanced Transaction Security Policies
Enhanced Transaction Security Metering
Test and Troubleshoot Your New Enhanced Policy
Migrate Legacy Policies to the Enhanced Transaction Security Framework
Choose an Event for the Enhanced Policy
Choose Event Fields for the Enhanced Policy Conditions
Create a Policy with a UI or with Apex Code
Differences Between the Legacy and Enhanced Apex Interfaces
Policy Migration Examples
Threat Detection
Security Guidelines for Apex and Visualforce Development
API End-of-Life
PDF

Newer Version Available

This content describes an older version of this product. View Latest

Choose an Event for the Enhanced Policy

The enhanced transaction security framework supports different events than the legacy framework.
Available in: Salesforce Classic and Lightning Experience
Available in: Enterprise, Unlimited, and Developer Editions

Requires Salesforce Shield or Salesforce Event Monitoring add-on subscriptions.

When you create a legacy policy, you first choose an event type and then a resource based on that event. The legacy event types are:

  • Data Export—Monitors both API queries and report exports.
  • Resource Access—Monitors when a report or dashboard is viewed.
  • Login—Monitors logins from the UI or API.
  • Entity—Monitors Chatter activity.

The enhanced framework is simpler because you choose just one event and no resource. The events you can use in an enhanced transaction security policy are a subset of the Real-Time Event Monitoring event objects.

These legacy event types have equivalent events in the enhanced framework.

Table 1. Mapping of Legacy Event Type to Real-Time Event Monitoring Events
If you used this event type in your legacy policy... Use this event in the new enhanced policy.
Data Export (for monitoring API queries) ApiEvent
Data Export (for monitoring report exports) ReportEvent
Resource Access ReportEvent
Login LoginEvent
Entity No equivalent.

In the legacy framework, report operations are split between two event types: Data Export monitors report exports, and Resource Access monitors report views. In the enhanced framework, ReportEvent monitors both report exports and report views. As a result, enhanced policies that you create on ReportEvent execute during both report exports and report views. If you want to monitor only one type of report operation, such as report exports, add a condition on the ReportEvent.Operation field.

Warning

Follow Along with the Lead Data Export Example

Let’s look at the legacy Lead Data Export policy example and choose an event for the new enhanced policy.

The legacy Lead Data Export policy blocks excessive downloads of lead data and is based on the Data Export event type. Data Export maps to either ApiEvent or ReportEvent, depending on whether you’re monitoring API queries or report exports.

  • To block excessive lead data downloads from API queries, create an enhanced policy on ApiEvent.
  • To block the downloads from report exports, create an enhanced policy on ReportEvent.
  • To block the downloads from both API queries and report exports, create two enhanced policies, one on ApiEvent and one on ReportEvent.

This migration example focuses on the last option and creates two policies, one based on ApiEvent, and the other based on ReportEvent.