LoginAnomalyEventStore
Stores the records of data access anomalies that are caused by potentially malicious login actions. This object is available in API version 64.0 and later.
describeLayout(), describeSObjects(), getDeleted(), getUpdated(), query()
Accessing this object requires either the Salesforce Shield or Event Monitoring add-on subscription and the View Real-Time Event Monitoring Data user permission.
The Machine Learning (ML) models that power Threat Detection analyze data to ensure accurate identification, which requires a brief processing time. This results in an expected time difference between the Event Detection Date and the Event Creation Date.
Type: double
Properties: Filter, Nillable, Sort
Description: A date value that represents aggregated timeframe of when Login Anomaly Actions occured
Type: dateTime
Properties: Filter, Sort
Description: A date value (no time portion) that represents aggregate timeframe when the login anomaly actions occurred.
Type: string
Properties: Filter, Group, Sort
Description: The unique ID of the event, which is shared with the corresponding storage object
Type: double
Properties: Filter, Nillable, Sort
Description: The feature’s contribution towards triggering an anomaly event.
Type: string
Properties: Filter, Group, Nillable, Sort
Description: The feature’s name.
Type: double
Properties: Filter, Nillable, Sort
Description: The feature’s value.
Type: dateTime
Properties: Filter, Nillable, Sort
Description: The date the event was last referenced.
Type: dateTime
Properties: Filter, Nillable, Sort
Description: The date the event was last viewed.
Type: string
Properties: Autonumber, Defaulted on create, Filter, idLookup, Sort
Description: The number of the event.
Type: string
Properties: Filter, Group, Nillable, Sort
Description: The string that ties together all events in a given user’s login session.
Type: reference
Properties: Filter, Group, Nillable, Sort
Description: The ID of the transaction policy associated with this event. For example, 0NIB000000000KOOAY. This field is a relationship field.
Relationship Name: Policy
Refers To: TransactionSecurityPolicy
Type: picklist
Properties: Filter, Group, Nillable, Restricted picklist, Sort
Description: The result of the transaction policy. Picklist type.
Type: double
Properties: Filter, Nillable, Sort
Description: Specifies how significant the new browser fingerprint deviates from the previous one.
Type: textarea
Properties: Nillable
Description: The content data of the security event.
Type: string
Properties: Filter, Group, Nillable, Sort
Description: The user’s unique session ID. Use this value to identify all user events within a session.
Type: string
Properties: Filter, Group, Nillable, Sort
Description: The source IP address of the client that logged in. For example, 126.7.4.2.
Type: textarea
Properties: Nillable
Description: A text summary of the threat that caused this event to be created. The summary lists the browser fingerprint features that most contributed to the threat detection along with their contribution to the total score.
Type: reference
Properties: Filter, Group, Nillable, Sort
Description: The origin user’s unique ID. For example, 005000000000123. This field is a polymorphic relationship field.
Relationship Name: User
Refers To: User
Type: string
Properties: Filter, Group, Nillable, Sort
Description: The origin username in the format of user@company.com at the time the event was created.