---
title: Salesforce login from disabled account
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Salesforce login from disabled account
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Salesforce login from disabled account
Classification:attackTactic:[TA0006-credential-access](https://attack.mitre.org/tactics/TA0006)Technique:[T1110-brute-force](https://attack.mitre.org/techniques/T1110) 
## Goal{% #goal %}

Detect when a disabled or frozen user account attempts to log in to Salesforce.

## Strategy{% #strategy %}

This rule monitors Salesforce login events through both Event Log File (ELF) and Real Time Event Monitoring (RTEM) logging tiers.

For `@evt.name:Login` events, this rule monitors `@login_status` for `LOGIN_ERROR_USER_INACTIVE` or `LOGIN_ERROR_USER_FROZEN` values.

For `@evt.name:LoginEvent` events, this rule monitors `@status` for `User is Inactive` or `User is Frozen` values.

If three or more authentication attempts occur for the same disabled or frozen user account, a signal is created. Login attempts categorized as corporate VPN traffic are excluded.

## Triage & Response{% #triage--response %}

- Examine the IP address, ASN, and geographic location associated with the login attempts for the user account.
- Review the user account for any successful login attempts.
- Verify if the IP address has attempted to log in to other user accounts within your Salesforce environment.
- If the IP address or user account demonstrates evidence of suspicious activities, initiate your incident response plan.

## Changelog{% #changelog %}

- 12 September 2026 - The rule now monitors disabled or frozen account login attempts in both ELF and RTEM logging tiers. The threshold is three or more attempts.