Interpreting Report Metadata from Security Logs

Report Type

This determines what objects are included in the report. If the Report Type is a numeric value rather than an Entity ID, it indicates it is a Salesforce Standard Report Type and can be found below in the Standard Report Types table. If the Report Type is an Entity ID, it is a Custom Report Type.

&rt= [Report Type]

Standard Filters

These generally includes the Date/Time field and range.

&colDt_c= [Date/Time Field]
&colDt_e= [Range End]
&colDt_q= [Range Description]
&colDt_s= [Range Start]

Note: An “all time” report has no start or end value and shows “custom” for the Range Description.

Advanced Filters

These are custom filters to refine the report results.

&pcX= [Filter Field]
&pnX= [Filter Operator]
&pvX= [Filter Value]

There are three components to each filter: Field, Operator, and Value. These appear as &pcX=, &pnX=, and &pvX=, respectively. The "X" component increments depending on the number of filters.

For example, a report with two filters includes the following:

&pc0=[Field1]&pc1=[Field2]&pn0=[Operator1]&pn1=[Operator2]&pv0=[Value1]&pv1=[Value2]

This can be broken down as follows:

Filter 1: &pc0=[Field1] , &pn0=[Operator1] , &pv0=[Value1]
Filter 2: &pc1=[Field2] , &pn1=[Operator2] , &pv1=[Value2]

Operators appear as two-character codes.

Code	Operator
eq	Equals
ne	Not equal to
co	Contains
nc	Does not contain
sw	Starts with
gt	Greater than
lt	Less than
ge	Greater or equal
le	Less or equal

Filter Logic

Filter logic (for example: "1 AND 2 AND ( 3 OR 4 OR 5 ) AND 6") does not appear in security log metadata.

Additional Report Details

Other report attributes can also be extracted.

&cust_name= [Report Name]
&cust_devName= [API Name]
&cust_desc= [Report Description]
&cust_owner= [Report Owner]
&last_modified_by= [Last Modified User Name]
&last_modified_date= [Last Modified Date]
&last_modified_user_id= [Last Modified User ID]
&id= [Report ID]

Notes on formatting: A plus sign (+) indicates a space. Other special characters are encoded. Please see the chart below for common encoded characters.

Note on EntityIDs: You can determine what object or record the EntityID refers to by entering the EntityID in the Address Bar after the "salesforce.com/" portion of the organization URL.

For example: https://na1.salesforce.com/[EntityID]

This displays the details for whatever entity has been entered.

Standard Report Types

&rt=	Report Type	&rt=	Report Type	&rt=	Report Type
01	ACCOUNT_LIST	22	OPPORTUNITY_LIST	44	LEAD_OWNER
02	CONTACT_LIST	24	ACTIVITY_LIST	45	ACCOUNT_PARTNER
03	TRAINING	25	OPPORTUNITY_SCHEDULE	46	CONTRACT_LIST
04	CAMPAIGN_LIST	26	OPPORTUNITY_CONTACT	47	ACCOUNT_OWNER
05	CAMPAIGN_CALLDOWN	27	OPPORTUNITY_HISTORY	48	DOCUMENT_LIST
06	CAMPAIGN_CONTACT	28	OPPORTUNITY_LEAD	49	ACCOUNT_TEAM
07	CAMPAIGN_LEAD	29	OPPORTUNITY_PARTNER	50	OPPORTUNITY_COMPETITOR
08	CAMPAIGN_MEMBER	30	OPPORTUNITY_PRODUCT	51	CUSTENT
09	CAMPAIGN_OPPORTUNITY	31	OPPORTUNITY_TEAM	52	ACCOUNT_CUSTENT
10	CASE_LIST	32	USER_LIST	53	CONTACT_CUSTENT
11	EMAIL_STATUS	33	SOLUTION_LIST	54	LEAD_CUSTENT
12	FORECAST	34	CSS_USAGE	55	OPPORTUNITY_CUSTENT
13	FORECAST_ACTUAL	35	CSS_USER	56	CAMPAIGN_CUSTENT
14	FORECAST_HISTORY	36	ACTIVITY_CONTRACT	57	CASE_CUSTENT
15	ACTIVITY_ACCOUNT	37	ACTIVITY_CAMPAIGN	58	CONTRACT_CUSTENT
16	ACTIVITY_CASE	38	PAYMENT_LIST	59	CUSTENT_CUSTENT
17	ACTIVITY_CONTACT	39	INVOICE_LIST	60	PRODUCT_LIST
18	ACTIVITY_LEAD	40	INVOICE_ITEM	61	PRICEBOOK_PRODUCT
19	ACTIVITY_OPPORTUNITY	41	ORDER_LIST	62	CONTRACT_APPROVAL
20	LEAD_CHART	42	ORDER_ITEM	63	CASE_HISTORY
21	LEAD_LIST	43	BILLED_PRODUCT	64	PRODUCT_OPPORTUNITY

Common Encoded Characters

Character	Code	Character	Code	Character	Code
!	%21	,	%2C	[	%5B
"	%22	-	%2D	\	%5C
#	%23	.	%2E	]	%5D
$	%24	/	%2F	^	%5E
%	%25	:	%3A	_	%5F
&	%26	;	%3B	`	%60
'	%27	<	%3C	{	%7B
(	%28	=	%3D	\|	%7C
)	%29	>	%3E	}	%7D
*	%2A	?	%3F	~	%7E
+	%2B	@	%40

Also, See - Interpreting the Forensic Logs

Interpreting Report Metadata from Security Logs