vulkro-sf org login-history
Checks the live org's recent logins for anomalies and its privileged profiles for weak login policy.
vulkro-sf org login-history --target-org <alias>
vulkro-sf org login-history -o <alias> --format json
| Finding | Severity | Meaning |
|---|---|---|
SF-LOGIN-HISTORY-001 | High | An admin logged in from an IP outside the trusted profile ranges. |
SF-LOGIN-HISTORY-002 | Medium | At least 5 failed logins for one user. |
SF-LOGIN-HISTORY-003 | Medium | An admin logged in over the legacy SOAP or application path. |
SF-LOGIN-POLICY-001 | Medium | A privileged profile has no IP allowlist. |
SF-LOGIN-POLICY-002 | High | A privileged profile does not require phishing-resistant MFA. |
SF-LOGIN-POLICY-003 | Medium | A profile's session timeout is too long. |
It reads the latest 1000 login rows, so a busy org can push older logins out of the window. SF-LOGIN-HISTORY-001 needs at least one trusted IP range to compare against; without one, SF-LOGIN-POLICY-001 reports the missing allowlist instead.
See also: org session, org mfa.