Event Monitoring

With Event Monitoring, gain greater insights into:

• Who viewed what data and when
• Where data was accessed
• When a user changes a record using the UI
• Who is logging in and from where
• Who in your org is performing actions related to Platform Encryption administration
• Which admins logged in as another user and the actions the admin took as that user
• How long it takes a Lightning page to load
• Threats detected in your org, such as anomalies in how users view or export reports, session hijacking attacks, or credential stuffing attacks

As a best practice, before creating transaction security policies, you can view or query events to determine appropriate thresholds for normal business usage.

• Quick Start: Event Monitoring
  If you're new to Event Monitoring, this quick start guide walks you through the most direct path to get set up. Event Monitoring gives you access to detailed performance, security, and usage data on all of your Salesforce apps.
• Event Monitoring Definitions
  Keep these terms in mind when working with Event Monitoring and real-time events.
• Enable Access to Event Monitoring
  You can set user access to Event Monitoring through profiles and permission sets.
• Considerations for Using Event Monitoring
  Keep these considerations in mind as you set up and use Real-Time Event Monitoring.
• Real-Time Events
  Subscribe to real-time Events published by Salesforce to monitor activity in your org. You can store the event data for auditing or reporting purposes. You can also create transaction security policies by using Condition Builder—a point-and-click tool—or Apex code. You can subscribe to this data from an external data system of your choice.
• Transaction Security
  Transaction Security is a framework that intercepts real-time events and applies appropriate actions to monitor and control user activity. Each transaction security policy has conditions that evaluate events and the real-time actions that are triggered after those conditions are met. The actions are Block, Multi-Factor Authentication, and Notifications. Before you build your policies, understand the available event types, policy conditions, and common use cases. Transaction Security is included in Real-Time Event Monitoring.
• Threat Detection
  Threat Detection uses statistical and machine learning methods to detect threats to your Salesforce org. While Salesforce identifies these threats for all Salesforce customers, you can view the information in the events with Threat Detection in Event Monitoring and investigate further if necessary. Threat Detection events do not count towards standard object storage limits.
• Event Log File Browser
  Event Log File (ELF) Browser in Setup gives you quick access to event log files so you can explore and download all of your event log file data.
• Store and Query Log Data with Event Log Objects
  The Event Log Object framework surfaces event data stored in standard objects called Event Log Objects. They store critical event data that you can query via Salesforce Platform APIs. Event log objects contain many but not all events currently represented in the Event Log File framework. Unlike Event Log Files, which surface event data as CSV files, Event Log Objects allow querying of similar data via SOQL.