---
title: Salesforce suspicious search query within UI
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Salesforce suspicious search query
  within UI
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Salesforce suspicious search query within UI
Classification:attackTactic:[TA0009-collection](https://attack.mitre.org/tactics/TA0009)Technique:[T1213-data-from-information-repositories](https://attack.mitre.org/techniques/T1213) 
## Goal{% #goal %}

Detect when a user searches for suspicious keywords in Salesforce.

## Strategy{% #strategy %}

This event type records searches users perform in the Salesforce environment, including Experience Cloud sites. If you have sensitive clients or are investigating potential insider behavior, use the search query field to review searches for those records.

You must correlate the log event with the `@usr.id` field for more context. This log type does not populate session key, login key, IP address, or user agent information.

Using Event Log File (ELF) logs, this rule monitors for search events.

For `Search` events, search queries that include suspicious keywords generate a signal. In these logs, `@search_query` provides the associated name and `@num_results`.

To learn more, see the [Search Event Type](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile_search.htm) documentation.

## Triage and response{% #triage-and-response %}

- Examine the associated user ID and triggering search event within the Salesforce audit logs.
- Determine if the search query includes requests for sensitive or confidential information. Review the number of results returned,`{{@num_results}}`, for context on potential data compromise.
- If the query successfully returned sensitive or confidential information, revoke user access and review audit logs for additional events. If data exfiltration occurred, initiate your incident response plan.