vulkro-sf org event-monitoring
Checks the live org's Event Monitoring log files for signs of data theft, brute force and abuse. Needs Salesforce Shield Event Monitoring; without it, the command says the add-on is missing.
vulkro-sf org event-monitoring --target-org <alias>
vulkro-sf org event-monitoring -o <alias> --since-days 30 --format json
| Finding | Severity | Meaning |
|---|---|---|
SF-EVENT-MON-001 | High | A Bulk API job processed more than 50,000 records. |
SF-EVENT-MON-002 | High | A non-admin user ran more than 1,000 deletes. |
SF-EVENT-MON-003 | Medium | A report was exported outside 06:00 to 22:00 UTC. |
SF-EVENT-MON-004 | High | More than 10 failed logins for one user. |
SF-EVENT-MON-005 | Medium | An Apex run took more than 10 seconds. |
SF-EVENT-MON-006 | Medium | More than 5 unexpected Apex exceptions. |
SF-EVENT-MON-007 | High | A guest user touched more than 100 records. |
SF-EVENT-MON-008 | High | More than 5,000 API requests from one user. |
SF-EVENT-MON-009 | High | More than 10 related error events (Apex, API and Lightning). |
--since-days <n> sets the lookback window (default 7, or VULKRO_SF_EVENT_MON_SINCE_DAYS).
It reads log file summary rows, not each event. A big Bulk API job is often a scheduled load.
See also: Event Monitoring detectors, org audit-trail.