vulkro-sf logs
Runs the Event Monitoring anomaly rules over an EventLogFile export already on disk, with no org connection. It is the offline twin of vulkro-sf org event-monitoring.
vulkro-sf logs analyze --input eventlogs.csv
vulkro-sf logs analyze -i eventlogs.csv --login-input loginhistory.csv --audit-input audittrail.csv
vulkro-sf logs export -i eventlogs.csv --format splunk -o findings.ndjson
The input is a JSON array of EventLogFile rows or a Salesforce LogFile CSV; the format is detected automatically. Large CSV files are streamed, never loaded whole.
logs analyze
Prints the findings: SF-EVENT-MON-001 to -010, -013, -014, -017 and the behavioural outlier rule SF-EVENT-MON-ANOMALY-001. Companion exports turn on more rules.
| Flag | What it does |
|---|---|
-i, --input <file> | The EventLogFile export. Required. |
--login-input <file> | A LoginHistory export. Adds impossible travel (-011), token reuse (-012), new-IP-then-export (-CORR-002) and device-fingerprint spread (SF-SESSION-FP-001). |
--audit-input <file> | A SetupAuditTrail export. Adds grant-then-exfil (-CORR-001) and grant velocity (-015). |
--rules <file> | Your own threshold rules (YAML), reported as SF-EVENT-MON-CUSTOM-<id>. |
--tsp-rules <file> | Transaction Security Policy rules (YAML), reported as SF-EVENT-MON-016-<id>. |
--format <table|json> | Output format. Default table. |
Rule thresholds can be tuned with VULKRO_SF_EVENT_MON_* variables; vulkro-sf logs analyze --help lists them with their defaults.
logs export
Runs the same rules with the same input flags, and writes the findings as one JSON event per line (NDJSON) for a SIEM. Each event carries a MITRE ATT&CK technique.
| Flag | What it does |
|---|---|
--format <splunk|sumo|datadog|ecs> | Target schema. Default splunk. |
-o, --output <file> | Write to a file instead of stdout. |
vulkro-sf logs export --help shows the YAML schema for --rules and --tsp-rules.
To capture a live org's state for offline analysis, use vulkro-sf org forensic-snapshot.
Exit codes
| Code | Meaning |
|---|---|
0 | No findings. |
1 | Findings reported. |
2 | Error (input unreadable or malformed, output not writable). |