GuestUserAnomalyEventStore
Tracks data access anomalies that are caused by guest user permission misconfiguration. GuestUserAnomalyEventStore is an object that stores the event data of GuestUserAnomalyEvent. This object is available in API version 60.0 and later.
describeLayout(), describeSObjects(), getDeleted(), getUpdated(), query()
Accessing this object requires either the Salesforce Shield or Event Monitoring add-on subscription and the View Real-Time Event Monitoring Data user permission.
The Machine Learning (ML) models that power Threat Detection analyze data to ensure accurate identification, which requires a brief processing time. This results in an expected time difference between the Event Detection Date and the Event Creation Date.
Type: double
Properties: Filter, Nillable, Sort
Description: The amount of time it took to evaluate the policy in milliseconds.
Type: dateTime
Properties: Filter, Sort
Description: A date value that represents the aggregate timeframe when the guest user’s actions occurred.
Type: string
Properties: Filter, Group, Sort
Description: The unique ID of the event, which is shared with the corresponding storage object.
Type: string
Properties: Autonumber, Defaulted on create, Filter, idLookup, Sort
Description: The unique number automatically assigned to the event when it’s created. You can’t change the format or value for this field.
Type: dateTime
Properties: Filter, Nillable, Sort
Description: The date the event was last referenced.
Type: dateTime
Properties: Filter, Nillable, Sort
Description: The date the event was last viewed.
Type: string
Properties: Filter, Group, Nillable, Sort
Description: The string that ties together all events in a given user’s login session. The session starts with a login event and ends with either a logout event or the user session expiring. For example, lUqjLPQTWRdvRG4.
Type: reference
Properties: Filter, Group, Nillable, Sort
Description: The ID of the transaction policy associated with this event. For example, 0NIB000000000KOOAY.
Relationship Name: Policy
Relationship Type: Lookup
Refers To: TransactionSecurityPolicy
Type: picklist
Properties: Filter, Group, Nillable, Restricted picklist, Sort
Description: The result of the transaction policy. Possible values include:
Error—The policy caused an undefined error when it was executed.ExemptNoAction—The user is exempt from transaction security policies, so the policy didn’t trigger.MeteringBlock—The policy took longer than 3 seconds to process, so the user was blocked from performing the operation.MeteringNoAction—The policy took longer than 3 seconds to process, but the user isn’t blocked from performing the operation.NoAction—The policy didn’t trigger.Notified—A notification was sent to the recipient.
Type: textarea
Properties: Nillable
Description: Objects queried by the guest user. For example:
Type: double
Properties: Filter, Nillable, Sort
Description: Specifies how significantly the guest user behavior deviates from the other guest users. It is formatted as a number between 0 and 1.
Type: textarea
Properties: Nillable
Description: The content data of the security event. This field is reserved for future use.
Type: string
Properties: Filter, Group, Nillable, Sort
Description: The user’s unique session ID. Use this value to identify all user events within a session.
Type: textarea
Properties: Nillable
Description: SOQL commands run by the guest user.
Type: string
Properties: Filter, Group, Nillable, Sort
Description: The source IP address of the client that logged in. For example, 126.7.4.2.
Type: textarea
Properties: Nillable
Description: A text summary of the threat that caused this event to be created. The summary lists the browser fingerprint features that most contributed to the threat detection along with their contribution to the total score.
Type: int
Properties: Filter, Group, Nillable, Sort
Description: The number of times controllers were triggered.
Type: string
Properties: Filter, Nillable, Sort
Description: User Agent for this event.
Type: reference
Properties: Filter, Group, Nillable, Sort
Description: The origin user’s unique ID. For example, 005000000000123. This field is a polymorphic relationship field.
Relationship Name: User
Relationship Type: Lookup
Refers To: User
Type: string
Properties: Filter, Group, Nillable, Sort
Description: The origin username in the format of user@company.com at the time the event was created.
Type: string
Properties: Filter, Group, Nillable, Sort
Description: Type of user of this event. For example, a guest user.