Classification:

attack

Tactic:

TA0009-collection

Technique:

T1213-data-from-information-repositories

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect when a user searches for suspicious keywords in Salesforce.

Strategy

This event type records searches users perform in the Salesforce environment, including Experience Cloud sites. If you have sensitive clients or are investigating potential insider behavior, use the search query field to review searches for those records.

You must correlate the log event with the @usr.id field for more context. This log type does not populate session key, login key, IP address, or user agent information.

Using Event Log File (ELF) logs, this rule monitors for search events.

For Search events, search queries that include suspicious keywords generate a signal. In these logs, @search_query provides the associated name and @num_results.

To learn more, see the Search Event Type documentation.

Triage and response

• Examine the associated user ID and triggering search event within the Salesforce audit logs.
• Determine if the search query includes requests for sensitive or confidential information. Review the number of results returned,{{@num_results}}, for context on potential data compromise.
• If the query successfully returned sensitive or confidential information, revoke user access and review audit logs for additional events. If data exfiltration occurred, initiate your incident response plan.