Note: This release is in preview. Features described here don’t become generally available until the latest general availability date that Salesforce announces for this release. Before then, and where features are noted as beta, pilot, or developer preview, we can’t guarantee general availability within any particular time frame or at all. Make your purchase decisions only on the basis of generally available products and features.

LoginAnomalyEventStore

Stores the records of data access anomalies that are caused by potentially malicious login actions. This object is available in API version 64.0 and later.

Supported Calls

describeLayout(), describeSObjects(), getDeleted(), getUpdated(), query()

Special Access Rules

Accessing this object requires either the Salesforce Shield or Event Monitoring add-on subscription and the View Real-Time Event Monitoring Data user permission.

The Machine Learning (ML) models that power Threat Detection analyze data to ensure accurate identification, which requires a brief processing time. This results in an expected time difference between the Event Detection Date and the Event Creation Date.

Note

Fields

Field	Details
EvaluationTime	Type double Properties Filter, Nillable, Sort Description A date value that represents aggregated timeframe of when Login Anomaly Actions occured
EventDate	Type dateTime Properties Filter, Sort Description A date value (no time portion) that represents aggregate timeframe when the login anomaly actions occurred.
EventIdentifier	Type string Properties Filter, Group, Sort Description The unique ID of the event, which is shared with the corresponding storage object
FeatureContribution	Type double Properties Filter, Nillable, Sort Description The feature's contribution towards triggering an anomaly event.
FeatureName	Type string Properties Filter, Group, Nillable, Sort Description The feature’s name.
FeatureValue	Type double Properties Filter, Nillable, Sort Description The feature’s value.
LastReferencedDate	Type dateTime Properties Filter, Nillable, Sort Description The date the event was last referenced.
LastViewedDate	Type dateTime Properties Filter, Nillable, Sort Description The date the event was last viewed.
LoginAnomalyEventNumber	Type string Properties Autonumber, Defaulted on create, Filter, idLookup, Sort Description The number of the event.
LoginKey	Type string Properties Filter, Group, Nillable, Sort Description The string that ties together all events in a given user’s login session.
PolicyId	Type reference Properties Filter, Group, Nillable, Sort Description The ID of the transaction policy associated with this event. For example, `0NIB000000000KOOAY`. This field is a relationship field. Relationship Name Policy Refers To TransactionSecurityPolicy
PolicyOutcome	Type picklist Properties Filter, Group, Nillable, Restricted picklist, Sort Description The result of the transaction policy. Picklist type.
Score	Type double Properties Filter, Nillable, Sort Description Specifies how significant the new browser fingerprint deviates from the previous one.
SecurityEventData	Type textarea Properties Nillable Description The content data of the security event.
SessionKey	Type string Properties Filter, Group, Nillable, Sort Description The user’s unique session ID. Use this value to identify all user events within a session.
SourceIp	Type string Properties Filter, Group, Nillable, Sort Description The source IP address of the client that logged in. For example, 126.7.4.2.
Summary	Type textarea Properties Nillable Description A text summary of the threat that caused this event to be created. The summary lists the browser fingerprint features that most contributed to the threat detection along with their contribution to the total score.
UserId	Type reference Properties Filter, Group, Nillable, Sort Description The origin user’s unique ID. For example, `005000000000123`. This field is a polymorphic relationship field. Relationship Name User Refers To User
Username	Type string Properties Filter, Group, Nillable, Sort Description The origin username in the format of `user@company.com` at the time the event was created.

Platform Events Developer Guide

LoginAnomalyEventStore

Supported Calls

Special Access Rules

Fields