Classification:

attack

Tactic:

TA0006-credential-access

Technique:

T1110-brute-force

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect a brute force attack on a Salesforce user.

Strategy

This rule monitors Salesforce login events through both Event Log File (ELF) and Real Time Event Monitoring (RTEM) logging tiers.

For @evt.name:Login events, this rule monitors @login_status for LOGIN_NO_ERROR, indicating a successful login, or LOGIN_ERROR_INVALID_PASSWORD, indicating a failed attempt to login using an invalid password.

For @evt.name:LoginEvent events, this rule monitors @status for Success, indicating a successful login, or Invalid Password, indicating a failed attempt to login using an invalid password.

A sequence of five or more failed login attempts followed by a successful login to a user account generates a Medium severity signal. Ten or more failed login attempts without a successful login generate an Info severity signal.

Triage and response

• Examine the IP address, ASN, and geographic location associated with the login attempts for the user account.
• Review the user account for any successful login attempts.
• Verify if the IP address has attempted to log in to other user accounts within your Salesforce environment.
• If the IP address or user account demonstrate evidence of suspicious activities, initiate your incident response plan.

Changelog

• 14 August 2026 - Added support for both Salesforce Real-Time Event Monitoring (LoginEvent / @status) and Event Log File (Login / @login_status) log formats by splitting failed and successful login queries into RTEM and ELF variants. Updated case conditions to fire when thresholds are met in either format.
• 2 September 2026 - Increased evaluation window from 5 minutes to 10 minutes.