TenantSecurityInvestigation

Represents a security investigation into threat anomalies detected in a tenant org that Security Center monitors. For more information, see Threat Detection. This object is available to Security Center subscribers in API version 66.0 and later.

Supported Calls

create(), delete(), describeLayout(), describeSObjects(), getDeleted(), getUpdated(), query(), retrieve(), undelete(), update(), upsert()

Special Access Rules

This object is read/write.

Fields

Field	Details
Category	Type picklist Properties Create, Filter, Group, Restricted picklist, Sort, Update Description The category of threat anomaly that this investigation examines. The values correspond to the Threat Detection anomaly types. Valid values are: `ApiAnomaly`—API Anomaly `CredentialStuffing`—Credential Stuffing `GuestUserAnomaly`—Guest User Anomaly `LoginAnomaly`—Login Anomaly `ReportAnomaly`—Report Anomaly `SessionHijacking`—Session Hijacking
DetectedTimestamp	Type dateTime Properties Create, Filter, Sort, Update Description The date and time when the triggering security event was detected.
EndTimestamp	Type dateTime Properties Create, Filter, Nillable, Sort, Update Description The date and time when the time window for the security event or incident ends.
IncidentDescription	Type textarea Properties Create, Nillable, Update Description A description of the triggering security event and its context.
InvestigationStage	Type picklist Properties Create, Filter, Group, Restricted picklist, Sort, Update Description The current stage of the investigation in its lifecycle. Valid values are: `Closed` `ClosedBenign`—Closed - Benign `ClosedResolved`—Closed - Resolved `Containment` `Investigating` `New`—Detected `Remediated` `Triaging` `ValidatedThreat`—Validated Threat
LastReferencedDate	Type dateTime Properties Filter, Nillable, Sort Description The timestamp when the current user last accessed this record indirectly, for example, through a list view or related record.
LastViewedDate	Type dateTime Properties Filter, Nillable, Sort Description The timestamp when the current user last viewed this record or list view. If this value is null, the user might have only accessed this record or list view (LastReferencedDate), but not viewed it.
Name	Type string Properties Autonumber, Defaulted on create, Filter, idLookup, Sort Description A unique, system-generated identifier for the TenantSecurityInvestigation record.
RiskScore	Type double Properties Create, Filter, Nillable, Sort, Update Description A calculated score that prioritizes the investigation.
StartTimestamp	Type dateTime Properties Create, Filter, Nillable, Sort, Update Description The date and time when the time window for the security event or incident starts.
TimeToResolve	Type long Properties Create, Filter, Group, Nillable, Sort, Update Description The number of seconds from the detection stage to the closed stage. This field is available in API version 67.0 and later.
Title	Type string Properties Create, Filter, Group, Nillable, Sort, Update Description A short title for the investigation.

Object Reference for the Salesforce Platform

TenantSecurityInvestigation

Supported Calls

Special Access Rules

Fields