Skip to main content

vulkro-sf org threat-detection

Event Monitoring Lite: threat detection from the event logs every org already has, without Shield. Reads the last day's free EventLogFile types (Login, Logout, API Total Usage; Report Export, Bulk API and URI when the org has them), LoginHistory and SetupAuditTrail, turns them into a compact normalised event list (no record data, usernames masked), and reports suspicious activity to investigate:

Command reference​

Generated from vulkro-sf org threat-detection --help (vulkro-sf 0.28.0). Run scripts/gen-docs.sh in the product repository to refresh it; do not edit this section by hand.

Event Monitoring Lite: threat detection from the event logs every org already has, without Shield. Reads the last day's free EventLogFile types (Login, Logout, API Total Usage; Report Export, Bulk API and URI when the org has them), LoginHistory and SetupAuditTrail, turns them into a compact normalised event list (no record data, usernames masked), and reports suspicious activity to investigate:

vulkro-sf org threat-detection [OPTIONS] --target-org <TARGET_ORG>

Options​

FlagDescription
-t, --target-org <TARGET_ORG>Target org alias or username, as known to sf org login
-f, --format <FORMAT>Output format: table, json or json-report. Default: table.
--baseline <BASELINE>An earlier --format json-report of this org (or a JSON list of its events): the baseline the API rules compare against.
-v, --verbose...Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins)
-q, --quietPrint only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged.
--no-colorTurn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb.
-h, --helpPrint help (see a summary with '-h')
Full vulkro-sf org threat-detection --help
Event Monitoring Lite: threat detection from the event logs every org already has, without Shield. Reads the last day's free EventLogFile types (Login, Logout, API Total Usage; Report Export, Bulk API and URI when the org has them), LoginHistory and SetupAuditTrail, turns them into a compact normalised event list (no record data, usernames masked), and reports suspicious activity to investigate:

SF-THREAT-001  admin / integration user signs in from a new IP network SF-THREAT-002  admin / integration user signs in from a new country SF-THREAT-003  a login through the OAuth device flow SF-THREAT-004  an event-log row matches a published campaign indicator SF-THREAT-005  API calls far above the user's own baseline SF-THREAT-006  a client the org's API log never saw before SF-THREAT-007  bulk export signal (Bulk API, report exports, Data Loader) SF-THREAT-008  Setup: Modify All Data / View All Data granted SF-THREAT-009  Setup: login IP ranges removed SF-THREAT-010  Setup: multi-factor authentication weakened SF-THREAT-011  Setup: a connected app policy relaxed SF-THREAT-012  Setup: a user made a System Administrator

Logins are compared with the user's own previous 90 days. The API rules (005, 006) need earlier days of API events: Salesforce keeps the free API log for one day, so pass `--baseline` with an earlier json-report (Vulkro Cloud keeps 90 days for you).

Read-only: SELECT queries plus a GET of each EventLogFile's LogFile through your `sf` login. A detection is a reason to investigate, never proof of a breach.

Formats: table, json (findings), json-report (findings, read coverage, events, detections, baseline, sources).

Exit codes: 0 = no detections; 1 = detections reported; 2 = error.

Usage: vulkro-sf org threat-detection [OPTIONS] --target-org <TARGET_ORG>

Options:
  -t, --target-org <TARGET_ORG>
          Target org alias or username, as known to `sf org login`

  -f, --format <FORMAT>
          Output format: table, json or json-report
          
          [default: table]

      --baseline <BASELINE>
          An earlier `--format json-report` of this org (or a JSON list of its `events`): the baseline the API rules compare against

  -v, --verbose...
          Bump stderr log verbosity. `-v` enables debug-level tracing for the `vulkro` + `vulkro_sf` targets; `-vv` enables trace. Honoured only when `RUST_LOG` is unset (an explicit `RUST_LOG` always wins)

  -q, --quiet
          Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged

      --no-color
          Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb

  -h, --help
          Print help (see a summary with '-h')
Last updated on