---
title: Salesforce brute force attack on user
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Salesforce brute force attack on user
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Salesforce brute force attack on user
Classification:attackTactic:[TA0006-credential-access](https://attack.mitre.org/tactics/TA0006)Technique:[T1110-brute-force](https://attack.mitre.org/techniques/T1110) 
## Goal{% #goal %}

Detect a brute force attack on a Salesforce user.

## Strategy{% #strategy %}

This rule monitors Salesforce login events through both Event Log File (ELF) and Real Time Event Monitoring (RTEM) logging tiers.

For `@evt.name:Login` events, this rule monitors `@login_status` for `LOGIN_NO_ERROR`, indicating a successful login, or `LOGIN_ERROR_INVALID_PASSWORD`, indicating a failed attempt to login using an invalid password.

For `@evt.name:LoginEvent` events, this rule monitors `@status` for `Success`, indicating a successful login, or `Invalid Password`, indicating a failed attempt to login using an invalid password.

A sequence of five or more failed login attempts followed by a successful login to a user account generates a `Medium` severity signal. Ten or more failed login attempts without a successful login generate an `Info` severity signal.

## Triage and response{% #triage-and-response %}

- Examine the IP address, ASN, and geographic location associated with the login attempts for the user account.
- Review the user account for any successful login attempts.
- Verify if the IP address has attempted to log in to other user accounts within your Salesforce environment.
- If the IP address or user account demonstrate evidence of suspicious activities, initiate your incident response plan.

## Changelog{% #changelog %}

- 14 August 2026 - Added support for both Salesforce Real-Time Event Monitoring (`LoginEvent` / `@status`) and Event Log File (`Login` / `@login_status`) log formats by splitting failed and successful login queries into RTEM and ELF variants. Updated case conditions to fire when thresholds are met in either format.