Salesforce Security Guide

Clouds with binary code floating aboveCloud with binary code floating above

No Results

Search Tips:

  • Please consider misspellings
  • Try different search keywords
Salesforce Security Guide
Salesforce Security Basics
Authenticate Users
Give Users Access to Data
Share Objects and Fields
Strengthen Your Data’s Security with Shield Platform Encryption
Audit and Monitor Your Organization’s Security
Real-Time Event Monitoring
Real-Time Event Monitoring Definitions
Considerations for Using Real-Time Event Monitoring
Enable Access to Real-Time Event Monitoring
Stream and Store Event Data
Create Logout Event Triggers
How Chunking Works with ReportEvent and ListViewEvent
Enhanced Transaction Security
Threat Detection
Event Log File Browser
Store and Query Log Data with Event Log Objects
Analyze Log Data with Salesforce Direct
Best Practices and Considerations for Leveraging Event Log Object Data
Security Guidelines for Apex and Visualforce Development
API End-of-Life Policy
PDF

Store and Query Log Data with Event Log Objects

The Event Log Object framework surfaces event data stored in standard objects called Event Log Objects. They store critical event data that you can query via Salesforce Platform APIs. Event log objects contain many but not all events currently represented in the Event Log File framework. Unlike Event Log Files, which surface event data as CSV files, Event Log Objects allow querying of similar data via SOQL.

As of Spring 25’, the Event Log Object framework only supports SOQL queries.

Note

This feature is only available to Hyperforce customers. Log data is retained for up to 30 days.

Important

Available in: Salesforce Classic (not available in all orgs), and Lightning Experience
Available in: Enterprise, Performance, and Unlimited Editions

Requires Salesforce Shield or Salesforce Event Monitoring add-on subscriptions.
User Permissions Needed

To query and view event log object data:

View Event Log Object Data

Event Log Object data is available with minimal delay, enabling earlier detection of security and performance incidents. Write advanced SOQL queries to filter or aggregate log data. Event Log Objects are also available to analyze in CRM Analytics using Salesforce Direct, so you can visualize data in a variety of chart types. Because you can access Event Log Objects via Salesforce Platform APIs, you can build custom applications in the Lightning UI for event specific use cases.

Enable Event Log Objects through the Event Manager tab in Setup:
  1. From Setup, in the Quick Find Box, enter Permission, and select Permission Sets.
  2. Select View Event Log Object Data to access all Event Log Objects. You can alternatively select Event Monitoring User to gain access to all of your Event Monitoring data.

Example

Sample Queries by Use Case
  • Security Query: Which users are exporting the most rows via reports?

    SELECT UserIdentifier, SUM(RowCount) FROM ReportEventLog WHERE Origin='ReportExported' AND DAY_ONLY(Timestamp) > LAST_N_DAYS:10 Group By UserIdentifier Order by SUM(RowCount) DESC

  • APM Query: What is the number of unexpected apex exceptions grouped by Exception Category?

    SELECT ExceptionCategory, COUNT(Timestamp) FROM ApexUnexpectedExcpEventLog WHERE DAY_ONLY(Timestamp) > LAST_N_DAYS:10 GROUP BY ExceptionCategory ORDER BY COUNT(Timestamp) DESC

  • Product Intelligence Query: What are the most loaded lightning pages?

    SELECT COUNT(Timestamp), PageUrl FROM LightningPageViewEventLog WHERE DAY_ONLY(Timestamp) > LAST_N_DAYS:10 GROUP BY PageUrl ORDER BY COUNT(Timestamp) DESC

Depending on event delivery and processing time, expect log data to be available to query within 25-45 minutes after the event is logged.

Note

You can only query 15 days of data at a time using the Timestamp column that’s present on all Event Log Objects. For more details on the limitations and valid formatting for this field see Best Practices and Considerations for Leveraging Event Log Object Data.

Important

For information about available Event Log Objects, see these topics in the Object Reference for the Salesforce Platform.

Event log objects aren't available in Government Cloud instances. If your org migrates, there’s potential to lose access to event log object data after migration completion. Contact Salesforce for any issues related to org migration.

Important

Debug and troubleshoot performance issues by correlating logs using the customizable Request Identifier field, available in all Event Monitoring logs. To correlate logs pertaining to an API request call, set the X-SFDC-REQUEST-ID header with a 32 character OTEL compatible TraceId or a 22 -character alphanumeric Id. Using SOQL, search for the Event Monitoring logs with this RequestId to correlate the logs and see the unit of work performed as a part of the API transaction.

Tip