mirror of
https://github.com/forcedotcom/afv-library.git
synced 2026-08-08 00:10:29 +08:00
95 lines
4.9 KiB
JSON
95 lines
4.9 KiB
JSON
{
|
||
"sections": [
|
||
"title",
|
||
"description",
|
||
"fields",
|
||
"special_access_rules",
|
||
"associated_objects"
|
||
],
|
||
"title": "TenantSecurityReportAnomaly - Data API",
|
||
"description": "Stores anomalies in how users run or export reports, including unsaved reports, as detected by Threat Detection. For more information, see Threat Detection. This object is available to Security Center subscribers in API version 53.0 and later.",
|
||
"fields_columns": [
|
||
"type",
|
||
"properties",
|
||
"description"
|
||
],
|
||
"fields": {
|
||
"DetailIdentifier": {
|
||
"type": "string",
|
||
"properties": "Filter, Group, idLookup, Sort",
|
||
"description": "The ID of the detail record. This field is unique within your org."
|
||
},
|
||
"EventDate": {
|
||
"type": "dateTime",
|
||
"properties": "Filter, Nillable, Sort",
|
||
"description": "The date when the hijacking event was reported. For example, 2020-01-20T19:12:26.965Z. The most granular setting is milliseconds."
|
||
},
|
||
"EventIdentifier": {
|
||
"type": "string",
|
||
"properties": "Filter, Group, idLookup, Nillable, Sort",
|
||
"description": "The unique ID of the event."
|
||
},
|
||
"EventName": {
|
||
"type": "string",
|
||
"properties": "Filter, Group, idLookup, Nillable, Sort",
|
||
"description": "The name of the event, which is Report Anomaly."
|
||
},
|
||
"MetricIdentifier": {
|
||
"type": "string",
|
||
"properties": "Filter, Group, Sort",
|
||
"description": "The ID of the type of metric that was counted."
|
||
},
|
||
"MetricsType": {
|
||
"type": "picklist",
|
||
"properties": "Filter, Group, Restricted picklist, Sort",
|
||
"description": "The type of data being collected."
|
||
},
|
||
"Name": {
|
||
"type": "string",
|
||
"properties": "Filter, Group, idLookup, Sort",
|
||
"description": "The name of the metric for which data is being collected."
|
||
},
|
||
"Report": {
|
||
"type": "string",
|
||
"properties": "Filter, Group, Nillable, Sort",
|
||
"description": "The ID for the report for which this anomaly event was detected. If the anomaly resulted from a user executing an unsaved report, the value of this field is null."
|
||
},
|
||
"Score": {
|
||
"type": "double",
|
||
"properties": "Filter, idLookup, Nillable, Sort",
|
||
"description": "A number from 0 through 100 that represents the anomaly score for the report execution or export tracked by this event. The anomaly score indicates how the user’s current report activity differs from their typical activity. A low score indicates that the current report activity is similar to the user’s usual activity. A high score indicates that it’s different."
|
||
},
|
||
"SecurityEventData": {
|
||
"type": "textarea",
|
||
"properties": "Nillable",
|
||
"description": "The set of features about the report activity that triggered this anomaly event. For example, a user typically downloads 10 accounts at a time, but then deviates from that pattern and downloads 1,000 accounts. This event is triggered, and the contributing features are captured in this field. Potential features include row count, column count, average row size, day of week, and the browser’s user agent used for the report activity. The data captured also shows as a percentage how much a particular feature contributed to this anomaly event. The data is in JSON format."
|
||
},
|
||
"Summary": {
|
||
"type": "textarea",
|
||
"properties": "Nillable",
|
||
"description": "A text summary of the report anomaly that caused this event."
|
||
},
|
||
"Tenant": {
|
||
"type": "string",
|
||
"properties": "Filter, Group, idLookup, Sort",
|
||
"description": "The ID of the tenant that was targeted in the event."
|
||
},
|
||
"TenantName": {
|
||
"type": "string",
|
||
"properties": "Filter, Group, idLookup, Nillable, Sort",
|
||
"description": "The name of the tenant that was targeted in the event."
|
||
},
|
||
"UserIdentifier": {
|
||
"type": "string",
|
||
"properties": "Filter, Group, Nillable, Sort",
|
||
"description": "The origin user’s unique ID."
|
||
},
|
||
"Username": {
|
||
"type": "string",
|
||
"properties": "Filter, Group, idLookup, Nillable, Sort",
|
||
"description": "The origin username in the format of user@company.com at the time the event was created."
|
||
}
|
||
},
|
||
"special_access_rules": "This object is read-only.",
|
||
"associated_objects": "This object has these associated objects. If the API version isn’t specified, it’s available in the same API versions as this object. Otherwise, it’s available in the specified API version and later.\n\n- **TenantSecurityReportAnomalyChangeEvent**: Change events are available for the object.\n- **TenantSecurityReportAnomalyFeed**: Feed tracking is available for the object.\n- **TenantSecurityReportAnomalyHistory**: History is available for tracked fields of the object.\n- **TenantSecurityReportAnomalyOwnerSharingRule**: Sharing rules are available for the object.\n- **TenantSecurityReportAnomalyShare**: Sharing is available for the object."
|
||
} |