mirror of
https://github.com/forcedotcom/afv-library.git
synced 2026-08-07 00:02:34 +08:00
140 lines
9.0 KiB
JSON
140 lines
9.0 KiB
JSON
|
{
|
|||
|
|
"sections": [
|
|||
|
|
"title",
|
|||
|
|
"description",
|
|||
|
|
"fields",
|
|||
|
|
"special_access_rules",
|
|||
|
|
"associated_objects"
|
|||
|
|
],
|
|||
|
|
"title": "TenantSecuritySessionHijacking - Data API",
|
|||
|
|
"description": "Stores information about session hijacking events as detected by Threat Detection within connected tenants in Security Center. For more information, see Threat Detection. This object is available for Security Center subscribers in API version 53.0 and later.",
|
|||
|
|
"fields_columns": [
|
|||
|
|
"type",
|
|||
|
|
"properties",
|
|||
|
|
"description"
|
|||
|
|
],
|
|||
|
|
"fields": {
|
|||
|
|
"CurrentIp": {
|
|||
|
|
"type": "string",
|
|||
|
|
"properties": "Filter, Group, Nillable, Sort",
|
|||
|
|
"description": "The IP address of the observed fingerprint that deviates from the previous fingerprint. The difference between the current and previous values is one indicator that a session hijacking attack has occurred. If the IP address didn’t contribute to the observed fingerprint deviation, the value of this field is the same as the PreviousIp field."
|
|||
|
|
},
|
|||
|
|
"CurrentPlatform": {
|
|||
|
|
"type": "string",
|
|||
|
|
"properties": "Filter, Group, Nillable, Sort",
|
|||
|
|
"description": "The platform of the observed fingerprint that deviates from the previous fingerprint. The difference between the current and previous values is one indicator that a session hijacking attack has occurred. If the platform didn’t contribute to the observed fingerprint deviation, the value of this field is the same as the PreviousPlatform field."
|
|||
|
|
},
|
|||
|
|
"CurrentScreen": {
|
|||
|
|
"type": "string",
|
|||
|
|
"properties": "Filter, Group, Nillable, Sort",
|
|||
|
|
"description": "The screen of the observed fingerprint that deviates from the previous fingerprint. The difference between the current and previous values is one indicator that a session hijacking attack has occurred. If the screen didn’t contribute to the observed fingerprint deviation, the value of this field is the same as the PreviousScreen field."
|
|||
|
|
},
|
|||
|
|
"CurrentUserAgent": {
|
|||
|
|
"type": "textarea",
|
|||
|
|
"properties": "Nillable",
|
|||
|
|
"description": "The user agent of the observed fingerprint that deviates from the previous fingerprint. The difference between the current and previous values is one indicator that a session hijacking attack has occurred. If the user agent didn’t contribute to the observed fingerprint deviation, the value of this field is the same as the PreviousUserAgent field."
|
|||
|
|
},
|
|||
|
|
"CurrentWindow": {
|
|||
|
|
"type": "string",
|
|||
|
|
"properties": "Filter, Group, Nillable, Sort",
|
|||
|
|
"description": "The browser window of the observed fingerprint that deviates from the previous fingerprint. The difference between the current and previous values is one indicator that a session hijacking attack has occurred. If the window didn’t contribute to the observed fingerprint deviation, the value of this field is the same as the PreviousWindow field."
|
|||
|
|
},
|
|||
|
|
"DetailIdentifier": {
|
|||
|
|
"type": "string",
|
|||
|
|
"properties": "Filter, Group, idLookup, Sort",
|
|||
|
|
"description": "The ID of the individual detail record. This field is unique within your org."
|
|||
|
|
},
|
|||
|
|
"EventDate": {
|
|||
|
|
"type": "dateTime",
|
|||
|
|
"properties": "Filter, Nillable, Sort",
|
|||
|
|
"description": "The date when the hijacking event was reported. For example, 2020-01-20T19:12:26.965Z. The most granular setting is milliseconds."
|
|||
|
|
},
|
|||
|
|
"EventIdentifier": {
|
|||
|
|
"type": "string",
|
|||
|
|
"properties": "Filter, Group, idLookup, Nillable, Sort",
|
|||
|
|
"description": "The unique ID of the event."
|
|||
|
|
},
|
|||
|
|
"EventName": {
|
|||
|
|
"type": "string",
|
|||
|
|
"properties": "Filter, Group, idLookup, Nillable, Sort",
|
|||
|
|
"description": "The name of the event, which is Session Hijacking."
|
|||
|
|
},
|
|||
|
|
"MetricIdentifier": {
|
|||
|
|
"type": "string",
|
|||
|
|
"properties": "Filter, Group, Sort",
|
|||
|
|
"description": "The ID of the type of metric that was counted."
|
|||
|
|
},
|
|||
|
|
"MetricsType": {
|
|||
|
|
"type": "picklist",
|
|||
|
|
"properties": "Filter, Group, Restricted picklist, Sort",
|
|||
|
|
"description": "The type of data being collected."
|
|||
|
|
},
|
|||
|
|
"Name": {
|
|||
|
|
"type": "string",
|
|||
|
|
"properties": "Filter, Group, idLookup, Sort",
|
|||
|
|
"description": "The name of the metric for which data is being collected."
|
|||
|
|
},
|
|||
|
|
"PreviousIp": {
|
|||
|
|
"type": "string",
|
|||
|
|
"properties": "Filter, Group, Nillable, Sort",
|
|||
|
|
"description": "The IP address of the previous fingerprint. The difference between the current and previous values is one indicator that a session hijacking attack has occurred. See the CurrentIp field for the newly observed IP address."
|
|||
|
|
},
|
|||
|
|
"PreviousPlatform": {
|
|||
|
|
"type": "string",
|
|||
|
|
"properties": "Filter, Group, Nillable, Sort",
|
|||
|
|
"description": "The platform of the previous fingerprint. The difference between the current and previous values is one indicator that a session hijacking attack has occurred. See the CurrentPlatform field for the newly observed platform."
|
|||
|
|
},
|
|||
|
|
"PreviousScreen": {
|
|||
|
|
"type": "string",
|
|||
|
|
"properties": "Filter, Group, Nillable, Sort",
|
|||
|
|
"description": "The screen of the previous fingerprint. The difference between the current and previous values is one indicator that a session hijacking attack has occurred. See the CurrentScreen field for the newly observed screen."
|
|||
|
|
},
|
|||
|
|
"PreviousUserAgent": {
|
|||
|
|
"type": "textarea",
|
|||
|
|
"properties": "Nillable",
|
|||
|
|
"description": "The user agent of the previous fingerprint. The difference between the current and previous values is one indicator that a session hijacking attack has occurred. See the CurrentUserAgent field for the newly observed user agent."
|
|||
|
|
},
|
|||
|
|
"PreviousWindow": {
|
|||
|
|
"type": "string",
|
|||
|
|
"properties": "Filter, Group, Nillable, Sort",
|
|||
|
|
"description": "The browser window of the previous fingerprint. The difference between the current and previous values is one indicator that a session hijacking attack has occurred. See the CurrentWindow field for the newly observed window."
|
|||
|
|
},
|
|||
|
|
"Score": {
|
|||
|
|
"type": "double",
|
|||
|
|
"properties": "Filter, idLookup, Nillable, Sort",
|
|||
|
|
"description": "Specifies how much the new fingerprint deviates from the previous one. The score is from 6.0 through 21.0. The event exposes five field pairs (such as CurrentIp and PreviousIp) to view the before and after data for browser features that contributed to this anomaly. See the SecurityEventData field for all contributing features in JSON format. A large deviation score (6.0 or more) between two intra-session fingerprints indicates that two different browsers are active in the same session. The presence of two active browsers usually means that session hijacking has occurred."
|
|||
|
|
},
|
|||
|
|
"SecurityEventData": {
|
|||
|
|
"type": "textarea",
|
|||
|
|
"properties": "Nillable",
|
|||
|
|
"description": "The set of browser fingerprint features that triggered this event. See the Threat Detection documentation for the possible features. For example, a user’s current browser fingerprint diverges from the previously known fingerprint. If Salesforce concludes the user’s session was hijacked, it fires this event, and the contributing features are captured in this field in JSON format. Each feature describes a browser fingerprint property, such as the browser user agent, window, or platform. The data includes the current and previous values for each feature."
|
|||
|
|
},
|
|||
|
|
"Summary": {
|
|||
|
|
"type": "textarea",
|
|||
|
|
"properties": "Nillable",
|
|||
|
|
"description": "A text summary of the threat that caused this event. The summary lists the browser fingerprint features that most contributed to the threat detection, along with their contribution to the total score."
|
|||
|
|
},
|
|||
|
|
"Tenant": {
|
|||
|
|
"type": "string",
|
|||
|
|
"properties": "Filter, Group, idLookup, Sort",
|
|||
|
|
"description": "The ID of the tenant that was targeted in the event."
|
|||
|
|
},
|
|||
|
|
"TenantName": {
|
|||
|
|
"type": "string",
|
|||
|
|
"properties": "Filter, Group, idLookup, Nillable, Sort",
|
|||
|
|
"description": "The name of the tenant that was targeted in the event."
|
|||
|
|
},
|
|||
|
|
"UserIdentifier": {
|
|||
|
|
"type": "string",
|
|||
|
|
"properties": "Filter, Group, Nillable, Sort",
|
|||
|
|
"description": "The origin user’s unique ID."
|
|||
|
|
},
|
|||
|
|
"Username": {
|
|||
|
|
"type": "string",
|
|||
|
|
"properties": "Filter, Group, idLookup, Nillable, Sort",
|
|||
|
|
"description": "The origin username in the format of user@company.com at the time that the event was created."
|
|||
|
|
}
|
|||
|
|
},
|
|||
|
|
"special_access_rules": "This object is read-only.",
|
|||
|
|
"associated_objects": "This object has these associated objects. If the API version isn’t specified, it’s available in the same API versions as this object. Otherwise, it’s available in the specified API version and later.\n\n- **TenantSecuritySessionHijackingChangeEvent**: Change events are available for the object.\n- **TenantSecuritySessionHijackingFeed**: Feed tracking is available for the object.\n- **TenantSecuritySessionHijackingHistory**: History is available for tracked fields of the object.\n- **TenantSecuritySessionHijackingOwnerSharingRule**: Sharing rules are available for the object.\n- **TenantSecuritySessionHijackingShare**: Sharing is available for the object."
|
|||
|
|
}
|