Choose Event Fields for the Enhanced Policy Conditions

Mapping Legacy Data Export Data Keys

When you migrate a legacy policy based on the Data Export event type to the enhanced framework, you choose either the ReportEvent or ApiEvent event.

Mapping Legacy Resource Access Data Keys

When you migrate a legacy policy based on the Resource Access event type, you use the ReportEvent event.

Mapping Legacy Login Data Keys

When you migrate a legacy policy based on the Login event type, you use the LoginEvent event. All fields in LoginHistoryID and LoginGeoId are now present in LoginEvent, with the exception of the legacy fields OptionIsGet and OptionIsPost, which map to LoginEvent.HttpMethod. Remove any queries for LoginHistoryId and LoginGeoId as they are no longer available during policy execution. Instead, use fields directly from LoginEvent.

Here’s the Apex code for a legacy policy that queries LoginHistoryId.

1global class SourceIpPolicyCondition implements TxnSecurity.PolicyCondition {
2    public boolean evaluate(TxnSecurity.Event e) {
3        String loginHistoryId = e.data.get('LoginHistoryId');
4        LoginHistory loginHistory = [SELECT SourceIp FROM LoginHistory WHERE Id = :loginHistoryId];
5        if (loginHistory.SourceIp.equals('1.1.1.1')) {
6            return true;
7        }
8        return false; 
9    }
10}

Here’s the Apex code for an enhanced policy that uses fields directly from LoginEvent.

1global class SourceIpEventCondition implements TxnSecurity.EventCondition {
2    public boolean evaluate(SObject event) {
3        LoginEvent loginEvent = (LoginEvent) event;
4        if (loginEvent.SourceIp.equals('1.1.1.1')) {
5            return true;
6        }
7        return false; 
8    }
9}

Follow Along with the Lead Data Export Example

Continuing with the two enhanced policies, we’re creating one based on ApiEvent, and the other based on ReportEvent.

Let's next determine the event properties used in the legacy Lead Data Export policy example and their equivalent fields in the two new enhanced policies.

The legacy policy triggers when a user’s download either:

• Retrieves more than 2,000 lead records
• Takes more than one second to complete

Here's the Apex code for the legacy policy. It uses the legacy event’s data Map<> for all its conditions.

1global class DataLoaderLeadExportCondition implements TxnSecurity.PolicyCondition {
2  public boolean evaluate(TxnSecurity.Event e) {
3    // The event data is a Map<String, String>.
4    // We need to call the valueOf() method on appropriate data types to use them in our logic.
5    Integer numberOfRecords = Integer.valueOf(e.data.get('NumberOfRecords'));
6    Long executionTimeMillis = Long.valueOf(e.data.get('ExecutionTime'));
7    String entityName = e.data.get('EntityName');
8
9    // Trigger the policy only for an export on leads, where we are downloading
10    // more than 2000 records or it took more than 1 second (1000ms).
11    if ('Lead'.equals(entityName)){
12      if (numberOfRecords > 2000 || executionTimeMillis > 1000){
13        return true;
14      }
15    }
16
17    // For everything else don't trigger the policy.
18    return false;
19  }
20}

This table lists the equivalent fields in the enhanced policies that you use for adding conditions.

Because the enhanced framework doesn’t monitor report execution times, you can’t add a condition for that value in your enhanced ReportEvent policy.

ReportEvent monitors both export and view operations. As a result, a policy based on ReportEvent executes whenever a user exports a report and also views a report. The legacy Data Export event type monitors only report exports. You can limit what a ReportEvent policy monitors by adding a condition on the ReportEvent.Operation field.