<  Back to rules search

Anomalous amount of Salesforce records deleted

salesforce

Classification:

attack

Tactic:

Technique:

Set up the salesforce integration.

Goal

Detect when there is a significant increase in deleted records in Salesforce.

Strategy

Inspect and baseline Salesforce logs and determine if there is a significant increase in successful (@evt.outcome:Success) delete operations (@operation:Delete).

Triage and response

  1. Determine if the user should be legitimately deleting Salesforce records.