ReportEventStream

• API—The user generated the report from an API call.
• Classic—The user generated the report from the Salesforce Classic UI.
• Lightning—The user generated the report from Lightning Experience.

For more information, see Sequence.

• CSV
• Excel

• Matrix
• MultiBlock
• Summary
• Tabular

• ChartRenderedInEmbeddedAnalyticsApp—Report executed from a rendered chart in an embedded Analytics app.
• ChartRenderedOnHomePage—Report executed from a rendered chart on the home page.
• ChartRenderedOnVisualforcePage—Report executed from a rendered chart on a VisualForce Page.
• DashboardComponentPreviewed—Report executed from a Lightning dashboard component preview.
• DashboardComponentUpdated—Report executed when a user refreshed a dashboard component. Because the report resulted from an asynchronous operation, session information, contained in the fields SessionKey, LoginKey, SessionLevel, and SourceIp, isn’t captured.
• ProbeQuery—Report executed from a probe query.
• ReportAddedToCampaign—Report was added from an Add to Campaign action.
• ReportExported—Report executed from a printable view or report export that wasn’t asynchronous nor an API export.
• ReportExportedAsynchronously—Report was exported asynchronously.
• ReportExportedUsingExcelConnector—Report was exported using the Excel connector.
• ReportOpenedFromMobileDashboard—Report executed when a user clicked a dashboard component on a mobile device and drilled down to a report.
• ReportPreviewed—Report executed when a user got preview results while using the report builder.
• ReportResultsAddedToEinsteinDiscovery—Report executed synchronously from Einstein Discovery.
• ReportResultsAddedToWaveTrending—Report executed when a user trended a report in Einstein Analytics.
• ReportRunAndNotificationSent—Report executed through the notifications API.
• ReportRunFromClassic—Report executed from the Run Report option of Salesforce Classic.
• ReportRunFromLightning—Report executed from the Run option in Lightning Experience from a non-mobile browser.
• ReportRunFromMobile—Report executed from the Run Report option of the mobile Salesforce app.
• ReportRunFromReportingSnapshot—Report executed through Snapshot Analytics.
• ReportRunFromRestApi—Report executed from REST API.
• ReportRunFromSlackElevate—Report executed from Slack Elevate.
• ReportRunUsingApexAsynchronousApi—Report executed from the asynchronous Apex API.
• ReportRunUsingApexSynchronousApi—Report executed from the synchronous Apex API.
• ReportRunUsingAsynchronousApi—Report executed from an asynchronous API.
• ReportRunUsingSynchronousApi—Report executed from a synchronous API.
• ReportScheduled—Report was scheduled.
• Test—Report execution resulted from a test.
• Unknown—Report execution origin is unknown.

• Block—The user was blocked from performing the operation that triggered the policy.
• Error—The policy caused an undefined error when it executed.
• ExemptNoAction—The user is exempt from transaction security policies, so the policy didn’t trigger.
• FailedInvalidPassword—The user entered an invalid password.
• FailedPasswordLockout—The user entered an invalid password too many times.
• MeteringBlock—The policy took longer than 3 seconds to process, so the user was blocked from performing the operation.
• MeteringNoAction—The policy took longer than 3 seconds to process, but the user wasn't blocked from performing the operation.
• NoAction—The policy didn't trigger.
• Notified—A notification was sent to the recipient.
• TwoFAAutomatedSuccess—Salesforce Authenticator approved the request for access because the request came from a trusted location. After users enable location services in Salesforce Authenticator, they can designate trusted locations. When a user trusts a location for a particular activity, such as logging in from a recognized device, that activity is approved from the trusted location for as long as the location is trusted.
• TwoFADenied—The user denied the approval request in the authenticator app, such as Salesforce Authenticator.
• TwoFAFailedGeneralError—An error caused by something other than an invalid verification code, too many verification attempts, or authenticator app connectivity.
• TwoFAFailedInvalidCode—The user provided an invalid verification code.
• TwoFAFailedTooManyAttempts—The user attempted to verify identity too many times. For example, the user entered an invalid verification code repeatedly.
• TwoFAInitiated—Salesforce initiated identity verification but hasn’t yet challenged the user.
• TwoFAInProgress—Salesforce challenged the user to verify identity and is waiting for the user to respond or for Salesforce Authenticator to send an automated response.
• TwoFANoAction—The policy specifies multi-factor authentication (formerly called two-factor authentication) as an action, but the user is already in a high-assurance session.
• TwoFARecoverableError—Salesforce can’t reach the authenticator app to verify identity, but will retry.
• TwoFAReportedDenied—The user denied the approval request in the authenticator app, such as Salesforce Authenticator, and also flagged the approval request to report to an administrator.
• TwoFASucceeded—The user’s identity was verified.

• For SELECT Contact.FirstName, Contact.Account.Name from Contact, the value of QueriedEntities is Account, Contact.
• For SELECT Account.Name, (SELECT Contact.FirstName, Contact.LastName FROM Account.Contacts) FROM Account, the value of QueriedEntities is Account, Contact.
• For SELECT Id, Name, Account.Name FROM Contact WHERE Account.Industry = 'media', the value of QueriedEntities is Account, Contact.

This field is populated only when the activity that this event monitors requires extra authentication, such as multi-factor authentication. In this case, Salesforce generates more events and sets the RelatedEventIdentifier field of the new events to the value of the EventIdentifier field of the original event. Use this field with the EventIdentifier field to correlate all the related events. If no extra authentication is required, this field is blank.

• user—User owns the objects the report was run against.
• team—Team owns the objects the report was run against.
• organization—Report was run against all applicable objects.

When a report execution returns many records, Salesforce splits this data into chunks based on the size of the records, and then creates multiple correlated ReportEventStreams. The field values in each of these correlated ReportEventStreams are the same, except for Records, which contains the different data chunks, and Sequence, which identifies each chunk in order. Every report execution has a unique ExecutionIdentifier value to differentiate it from other report executions. To view all the data chunks from a single report execution, use the Sequence and ExecutionIdentifier fields in combination.

When a report executes, we provide the first 1,000 events with data in the Records field. Use the ReportId field to view the full report.

• HIGH_ASSURANCE—A high assurance session was used for resource access. For example, when the user tries to access a resource such as a connected app, report, or dashboard that requires a high-assurance session level.
• LOW—The user’s security level for the current session meets the lowest requirements. This low level isn’t available, nor used, in the Salesforce UI. User sessions through the UI are either standard or high assurance. You can set this level using the API, but users assigned this level experience unpredictable and reduced functionality in their Salesforce org.
• STANDARD—The user’s security level for the current session meets the Standard requirements set in the org’s Session Security Levels.