Event Monitoring and offline forensics
These rules score Salesforce EventLogFile data for signs of an active or recent compromise, either from a live org or from an export on disk.
vulkro-sf org event-monitoring -o <alias> # live org, Shield Event Monitoring
vulkro-sf logs analyze --input <export.csv> # offline, an EventLogFile export already on disk
Analysis runs on your machine; no log data leaves it. Where a check maps to MITRE ATT&CK, the technique is in the finding (and in --format ocsf output).
Rules
| Rule ID | Severity | What it finds |
|---|---|---|
| SF-EVENT-MON-001 | High | A Bulk API job that pulled more than 50,000 rows. |
| SF-EVENT-MON-002 | High | More than 1,000 Bulk API deletes by a non-admin user. |
| SF-EVENT-MON-003 | Medium | A report export outside 06:00 to 22:00 UTC. |
| SF-EVENT-MON-004 | High | More than 10 failed logins for one user. |
| SF-EVENT-MON-005 | Medium | An Apex execution that ran longer than 10,000 ms. |
| SF-EVENT-MON-006 | Medium | More than 5 unhandled Apex exceptions. |
| SF-EVENT-MON-007 | High | A guest user touching more than 100 records. |
| SF-EVENT-MON-008 | High | More than 5,000 API requests from one user. |
| SF-EVENT-MON-009 | High | More than 10 correlated API and Lightning errors. |
| SF-EVENT-MON-010 | High | A user running or exporting reports far more often or widely than normal. |
| SF-EVENT-MON-011 | High | Successful logins for one user from two IP addresses minutes apart. |
| SF-EVENT-MON-012 | High | One session or OAuth token seen from more than one IP address or client. |
| SF-EVENT-MON-013 | High | A query many times more complex than the user's own baseline. |
| SF-EVENT-MON-014 | High | Exports, API reads or field changes that touch personal-data fields. |
| SF-EVENT-MON-015 | High | One actor making many dangerous permission or role grants in a short window. |
| SF-EVENT-MON-017 | High | A high combined API abuse score (request rate, concurrent sessions, token reuse). |
| SF-EVENT-MON-019 | High | A Visualforce render that returned an unusually large amount of data. |
| SF-EVENT-MON-020 | High | Many public content-share links created in a short time. |
| SF-EVENT-MON-021 | High | A large CRM Analytics download. |
| SF-EVENT-MON-022 | Medium | Many failed asynchronous Apex jobs. |
| SF-EVENT-MON-023 | Medium | An unusually high number of searches by one user. |
| SF-EVENT-MON-024 | High | Many callouts to other Salesforce orgs. |
| SF-EVENT-MON-ANOMALY-001 | Medium | A user whose data volume is a strong outlier against peers. |
| SF-EVENT-MON-CORR-001 | High | A permission grant followed shortly by a large export by the same user. |
| SF-EVENT-MON-CORR-002 | High | A login from a new IP address followed shortly by a large export. |
| SF-SESSION-FP-001 | High | Successful logins for one user from many distinct browser and platform fingerprints in a short window. |
Settings
| Variable | Default | Effect |
|---|---|---|
VULKRO_SF_EVENT_MON_SINCE_DAYS | 7 | Lookback window for org event-monitoring (overridden by --since-days). |
VULKRO_SF_EVENT_MON_DEVICE_FP_WINDOW_MINUTES | 60 | Window for SF-SESSION-FP-001. |
VULKRO_SF_EVENT_MON_DEVICE_FP_COUNT | 3 | Distinct fingerprints above which SF-SESSION-FP-001 fires. Raise it for roaming or BYOD users. |
These rules see only what the org logged. Activity inside a user's normal baseline leaves nothing to score.
See also: logs command, org event-monitoring