Anomalous amount of Salesforce records deleted

Classification:

attack

Tactic:

TA0040-impact

Technique:

T1485-data-destruction

Set up the salesforce integration.

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect when there is a significant increase in deleted records in Salesforce.

Strategy

Inspect and baseline Salesforce logs and determine if there is a significant increase in successful (@evt.outcome:Success) delete operations (@operation:Delete).

Triage and response

Determine if the user should be legitimately deleting Salesforce records.