Seeing what is really happening in your Salesforce environment

Most organizations know who has access to Salesforce. But knowing what users do with that access is an entirely different question. Who exported a large dataset yesterday? Who logged in from an unfamiliar country? Which API pulled thousands of records during the night?

Without Event Monitoring, these are questions you cannot answer. With Event Monitoring, you can.

Event Monitoring is part of Salesforce Shield and provides detailed logging of user activity, API usage and system events in your Salesforce environment. It is the layer that gives visibility into everything that happens behind the login screens.

What does Event Monitoring log exactly?

Event Monitoring captures dozens of event types. The most relevant ones for security and compliance are:

• Login events: when did who log in, from which IP address, through which browser or application, and was the login attempt successful?
• Logout events: when was a session ended, active or by timeout?
• Report events: who ran which report, how many records did it contain, and was it exported?
• API events: which external systems or users requested or modified data through the API, and how much?
• Lightning events: user interactions within the Lightning interface
• Bulk API events: large data transfers via the Bulk API, a commonly used channel in data theft
• URI events: navigation behavior of users through the Salesforce interface

The logs are stored as CSV files and are available through the Salesforce API. They can be installed into a SIEM system, a data warehouse or an analytics tool for further processing.

Transaction Security Policies: from monitoring to action

Event Monitoring gives you visibility. Transaction Security Policies give you the ability to intervene automatically based on that visibility.

A Transaction Security Policy is a rule that is evaluated at the moment a particular event occurs. If the rule matches, Salesforce can automatically take an action. Examples of policies organizations configure:

• Block the login when a user tries to log in from a country outside the approved list
• Send a notification to the security administrator when a user exports more than 1,000 records in a single session
• End the session automatically when a system administrator logs in outside office hours
• Block the download of reports containing sensitive fields for users without the appropriate permission

Transaction Security Policies can be configured through Salesforce Setup without writing code. For more complex scenarios they can be extended with Apex.

Field Audit Trail: historical logging at the field level

In addition to the real-time event logs, Salesforce Shield also offers Field Audit Trail: an extension that captures changes at the field level for up to ten years.

By default, Salesforce keeps a limited version history of records. Field Audit Trail extends this into a full audit log: who changed which field on which record, from which value to which value, and when?

This is particularly valuable for compliance programs that require demonstrability over a longer period, such as financial reporting, medical records or contract management.

How do you process Event Monitoring data effectively?

The raw logs from Event Monitoring are valuable, but only if you do something with them. In practice, there are three levels of maturity:

Level 1: Manual analysis. The logs are downloaded periodically and reviewed manually. This works for smaller environments but does not scale and lacks real-time detection.

Level 2: Dashboards and reporting. The logs are loaded into an analytics tool such as Tableau, Power BI or the native Salesforce dashboard for Event Monitoring. Administrators can spot trends and anomalies through visualizations.

Level 3: SIEM integration. The logs are forwarded in real time to a Security Information and Event Management system such as Splunk, Microsoft Sentinel or IBM QRadar. The SIEM correlates the Salesforce events with events from other systems, detects patterns and automatically generates alerts on anomalous behavior.

For enterprise environments, level 3 is the standard. The Salesforce Event Monitoring logs contain valuable signals, but their real strength emerges when combined with data from other sources.

Which signals should you watch for?

Event Monitoring is most valuable when you know which signals to watch for. The goal is to detect deviations from normal behavior before they become an incident. Signals that always warrant further investigation:

• A user exports significantly more data than average, or more than their function justifies
• Login attempts from unfamiliar locations or IP addresses that do not match the expected usage patterns
• API activity outside office hours on a service account that is normally only active during the day
• Multiple failed login attempts on the same account in a short period
• A user gaining access to objects or reports that fall outside their normal scope of work
• Bulk API usage that does not correspond to a planned data transfer

None of these signals on their own proves that something is wrong. But they all warrant a closer look.

Event Monitoring and compliance

For organizations subject to GDPR, ISO 27001, SOC 2 or sector-specific regulation, Event Monitoring is not optional but a requirement. Auditors want demonstrability: not only that access rights are correctly configured, but also that there is active oversight of how those rights are used.

Event Monitoring delivers the raw data for that demonstrability. Field Audit Trail provides the historical underpinning. Transaction Security Policies show that monitoring is not only happening but is also being acted upon.

Together they form the monitoring and detection layer that should be present in every mature Salesforce security architecture.

Conclusion

Event Monitoring answers the question that access management alone cannot: what are users actually doing with the access they have? It is the layer that gives visibility, detects anomalies and provides the evidence base during audits and incidents.

Organizations that actively use Event Monitoring and seriously analyze the data are not only better protected: they are also demonstrably in control. And that is precisely what auditors, regulators and customers increasingly expect.

Want to know how to set up Event Monitoring optimally for your Salesforce environment? Schedule a no-obligation conversation