vulkro-sf org audit-trail
Checks the live org's Setup Audit Trail for privilege escalation and Setup changes made out of hours.
vulkro-sf org audit-trail --target-org <alias>
vulkro-sf org audit-trail -o <alias> --check-apt-playbooks --format json
| Finding | Severity | Meaning |
|---|---|---|
SF-AUDIT-TRAIL-001 | High | A permission was escalated in the last 30 days. |
SF-AUDIT-TRAIL-002 | Medium | A Setup change was made out of hours. |
It reads the latest 1000 audit rows, so in a busy org older changes fall outside the window.
Flags
| Flag | Meaning |
|---|---|
--target-org, -o <alias> | Org alias or username from sf org login. Required. |
--format <fmt> | Output format. Default table. |
--check-apt-playbooks | Also match the audit trail and session timeline against the bundled attack playbooks (APT-CRED-EXFIL-001, APT-DATA-EXFIL-002, APT-PRIV-ESC-003, APT-LATERAL-MOVE-004, APT-PERSISTENCE-005). Same as VULKRO_SF_APT_PLAYBOOKS=1. |
A playbook match is a lead to investigate, not proof of a compromise.
See also: org login-history, org forensic-snapshot.