Salesforce Event Monitoring, keep control over your Org 📈!
Tags: Transaction Security, Einstein Analytics, Real Time, Event Monitoring, Salesforce

Event Monitoring

If you are looking to keep control over your Salesforce users’ activities, Event Monitoring is the right tool for you!

Whassat?

Event Monitoring is a Salesforce add-on product that allows you to secure your CRM data, as it offers the possibility to closely monitor user activity in order to :

Detecting possible data loss 🔎: for example, you can detect report exports made by users.

🔎: for example, you can detect report exports made by users. Increase the adoption rate 🚀: for example, you can detect the less used parts in your org and adapt your communication strategy in order to increase their use.

🚀: for example, you can detect the less used parts in your org and adapt your communication strategy in order to increase their use. Optimize performance 🔧: for example, you can detect performance issues on Visualforce pages and Lightning components.

Event Monitoring is available with an Event Monitoring license 📈 or with the Salesforce Shield 🛡️

There is two kinds of Event Monitoring

Standard Event Monitoring :

Standard Event Monitoring

The Standard Event monitoring allows you to track a lot of events that occur on a Salesforce Org, for example: Authentication (Logins, Logouts), API Calls, Apex Execution, etc… (the full list 📜 is available here). Event details are automatically stored in the EventLogFile object (accessible only via API),

Events are added to the EventLogFile object 24 hours after they occur and remain available for 30 days.

We will see in the visualization section the tools that you can use to analyze the data of the EventLogFile object.

Real-Time Event Monitoring :

Real-Time Event Monitoring

Real-Time Event Monitoring allows the generation (in near real-time) of a subset of events related to authentication (LoginEvent), API calls (ApiEvent), Actions on reports (ReportEvent), etc… (The full list 📜 of events is available here), real-time events can be configured to be stored in standard big objects (LoginEvent, ApiEvent…) or streamed via the Streaming API.

Real-Time Event Monitoring also includes the Transaction Security sub-module that allows you to define actions on real-time events.

Configuration

How to activate it ✅

Activate Event Monitoring

Standard Event Monitoring is activated with the purchase of the Event Monitoring license.

Real-Time Event Monitoring is also activated when the license is purchased, but the events are not automatically stored in the big objects.

In ⚙️ Setup → Event Monitoring Settings: click on Event Manager from the “Login Forensics” item, you can then choose the events to be stored and/or streamed via the Streaming API

The Transaction Security submodule is not automatically activated.

In ⚙ ️Setup → Transaction Security Policies: Click enable to activate it

How to configure it 🖱️?

Standard Event Monitoring: There are no configurations related to it, events are automatically added to the EventLogFile object after 24 hours.

Real-Time Event Monitoring: we will quickly detail the configurations available on the Transaction Security sub-module, which allows you to config actions according to certain conditions when a real-time event occurs.

The config is accessible via ⚙️Setup →Transaction Security Policies. You can create conditions with the Condition Builder or with Apex

Condition Builder :

Transaction Security : Configure with Condition Builder

Allows to create conditions without code, it offers a way to block 🛑 ️/force the two-factor authentication ✌️/notify 🔔

Examples :

Block the export of reports that matches a certain criteria

Force two-factor authentication for large exports (via API)

Block logging-in from a certain IP address

See the Salesforce doc for more examples

Apex :

Transaction Security : Configure with Apex

More advanced conditions can be created using Apex, just implement the standard TxnSecurity.EventCondition interface. Apex conditions allow to Block 🛑 or notify🔔

Examples:

Block data export via API/List View/Report according to certain criteria

See the Salesforce doc for more examples

Visualization

How to visualize the events 📊?

Visualize the events

The events stored in the EventLogFile object can be queried via SOQL (SOAP API) and the REST API, there is also an Event Log File Browser (Heroku) app that allows you to download the event files.

But if you are looking for a simple and interactive way to visualize the events, we recommend Einstein Analytics (Event Monitoring Analytics App) which is included in the Event Monitoring license.