Salesforce suspicious search query within UI
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.Goal
Detect when a user searches for suspicious keywords in Salesforce.
Strategy
This event type records searches users perform in the Salesforce environment, including Experience Cloud sites. If you have sensitive clients or are investigating potential insider behavior, use the search query field to review searches for those records.
You must correlate the log event with the @usr.id field for more context. This log type does not populate session key, login key, IP address, or user agent information.
Using Event Log File (ELF) logs, this rule monitors for search events.
For Search events, search queries that include suspicious keywords generate a signal. In these logs, @search_query provides the associated name and @num_results.
To learn more, see the Search Event Type documentation.
Triage and response
- Examine the associated user ID and triggering search event within the Salesforce audit logs.
- Determine if the search query includes requests for sensitive or confidential information. Review the number of results returned,
{{@num_results}}, for context on potential data compromise. - If the query successfully returned sensitive or confidential information, revoke user access and review audit logs for additional events. If data exfiltration occurred, initiate your incident response plan.
