| EvaluationTime |
- Type
- double
- Properties
- Nillable
- Description
- The amount of time it took to evaluate the policy in milliseconds. This field isn’t
populated until all transaction security policies are
processed for the real-time event.
|
| EventDate |
- Type
- dateTime
- Properties
- Nillable
- Description
- The time when the anomaly was reported. For example,
2020-01-20T19:12:26.965Z. Milliseconds are
the most granular setting.
|
| EventIdentifier |
- Type
- string
- Properties
- Nillable
- Description
- The unique ID of the event, which is shared with the
corresponding storage object. For example, 0a4779b0-0da1-4619-a373-0a36991dff90. Use this field to correlate
the event with its storage object.
|
| EventUuid |
- Type
- string
- Properties
- Nillable
- Description
- A universally unique identifier (UUID) that identifies
a platform event message. This field is available in API version 52.0 and
later.
|
| LoginKey |
- Type
- string
- Properties
- Nillable
- Description
- The string that ties together all events in a given user's login session. The session starts with a login event and ends with either a logout event or the user session expiring. For example, lUqjLPQTWRdvRG4.
|
| PolicyId |
- Type
- reference
- Properties
- Nillable
- Description
- The ID of the transaction policy associated with this event. For example,
0NIB000000000KOOAY. This field isn’t populated until all
transaction security policies are processed for the
real-time event.
- A relationship field.
- Relationship Name
- Policy
- Relationship Type
- Lookup
- Refers To
- TransactionSecurityPolicy
|
| PolicyOutcome |
- Type
- picklist
- Properties
- Nillable, Restricted picklist
- Description
- The result of the transaction policy. Possible values are:
-
Error - The
policy caused an undefined error when it
executed.
-
ExemptNoAction—The user is exempt
from transaction security policies, so the policy
didn’t trigger.
-
MeteringBlock—The policy took
longer than 3 seconds to process, so the user was
blocked from performing the operation.
-
MeteringNoAction—The policy took
longer than 3 seconds to process, but the user
isn't blocked from performing the operation.
-
NoAction -
The policy didn't trigger.
-
Notified -
A notification was sent to the recipient.
This field isn’t populated until all transaction
security policies are processed for the real-time
event.
|
| ReplayId |
- Type
- string
- Properties
- Nillable
- Description
- Represents an ID value that is populated by the system
and refers to the position of the event in the event stream. Replay ID values
aren’t guaranteed to be contiguous for consecutive events. A subscriber can
store a replay ID value and use it on resubscription to retrieve missed events
that are within the retention window.
|
| Report |
- Type
- string
- Properties
- Nillable
- Description
- The report ID for the report for which this anomaly
event was detected. For example, 00OD0000001leVCMAY.
If this anomaly
resulted from a user executing an unsaved report,
the value of this field is null.
|
| Score |
- Type
- double
- Properties
- Nillable
- Description
- A number from 0 through 1 that represents the anomaly score for the report execution
or export tracked by this event. The anomaly score shows
how the user's current report activity is different from
their typical activity. A low score indicates that the
user's current report activity is similar to their usual
activity. A high score indicates that it's different.
|
| SecurityEventData |
- Type
- textarea
- Properties
- Nillable
- Description
- The set of features about the report activity that triggered this anomaly event.
Let’s say, for example, that a user typically
downloads 10 accounts but then they deviate from
that pattern and download 1,000 accounts. This event
is triggered and the contributing features are
captured in this field. Potential features include
row count, column count, average row size, the day
of week, and the browser’s user agent used for the
report activity. The data captured in this field
also shows how much a particular feature contributed
to this anomaly event being triggered, represented
as a percentage. The data is in JSON
format.
- Example
- This example shows that the average row count
contributed more than 95% to the anomaly being
triggered. Other anomalous features, such as the
autonomous system, day of the week the report was run,
the browser used, and the number of columns, contributed
much less.
1[
2{
3"featureName": "rowCount",
4"featureValue": "1937568",
5"featureContribution": “95.00 %"
6},
7{
8"featureName": "autonomousSystem",
9"featureValue": "Bigleaf Networks, Inc.",
10"featureContribution": “1.62 %"
11},
12{
13"featureName": "dayOfWeek",
14"featureValue": "Sunday",
15"featureContribution": “1.42 %"
16},
17{
18"featureName": "userAgent",
19"featureValue": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36}",
20"featureContribution": “1.21 %"
21},
22{
23"featureName": "periodOfDay",
24"featureValue": “Evening”,
25"featureContribution": “.09 %"
26},
27{
28"featureName": "averageRowSize",
29"featureValue": "744",
30"featureContribution": “0.08 %"
31},
32{
33"featureName": "screenResolution",
34"featureValue": "900x1440",
35"featureContribution": “0.07 %"
36}
37]
|
| SessionKey |
- Type
- string
- Properties
- Nillable
- Description
- The user’s unique session ID. Use this value to identify all user events within a session. When a user logs out and logs in again, a new session is started. For example, vMASKIU6AxEr+Op5.
|
| SourceIp |
- Type
- string
- Properties
- Nillable
- Description
- The source IP address of the client that logged in. For example, 126.7.4.2. Session
information contained in the fields SessionKey,
LoginKey, SessionLevel, and SourceIp isn’t captured in
any report resulting from an asynchronous
operation.
|
| Summary |
- Type
- textarea
- Properties
- Nillable
- Description
- A text summary of the report anomaly that caused this
event to be created.
- Example
-
- Report was exported
from an infrequent network (BigLeaf Networks
Inc.)
- Report was generated
with an unusually high number of rows
(111141)
|
| UserId |
- Type
- reference
- Properties
- Nillable
- Description
- The origin user’s unique ID. For example, 005000000000123.
- A polymorphic relationship field.
- Relationship Name
- User
- Relationship Type
- Lookup
- Refers To
- User
|
| Username |
- Type
- string
- Properties
- Nillable
- Description
- The origin username in the format of user@company.com at the
time the event was created.
|
j