Salesforce Shield alert on anomaly event

Classification:

attack

Tactic:

Technique:

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect when Salesforce Shield generates an anomaly- or security-related alert.

Using logs generated by Salesforce Shield, this rule monitors for the following events:

To learn more, see the Salesforce Shield documentation.

Examine the associated user id and triggering security event within the Salesforce audit logs.
Determine if the type of anomaly event and pivot to related logs.
If alert detected suspicious or malicious behavior, revoke permissions and review audit logs for access events. If external access events occurred, initiate your incident response plan.