One of the many tools Salesforce offers to keep our data secure is 'Event Monitoring'. Event monitoring enables us to see precise information on specific user activities within your company. Such user actions referred to as 'events' can be monitored and used to spot unusual behavior and protect business data. Organizations will be able to monitor information about specific events/occurrences or also follow event trends and hence take appropriate preventive actions.
The event monitoring product gathers information about your Salesforce org’s all operational events, which are used to analyze usage trends and user behaviour.
By running queries against fields on the EventLogFile object, you can interact with event monitoring data (like EventType and LogDate). The log file's CreatedDate indicates when it was created. Inquire about the LogFile field to see the underlying event information. The schema for this field is determined by the EventType.
Accessing this object requires View Event Log Files and API Enabled user permissions. Users with View All Data permission can view event log files.
Below is the link for documentation of Eventlogfile object:
Some examples of some event type that you can track, There are over 50 event types that can be consumed.
There are many use cases we can imagine to take advantage of event monitoring from. Here are a few of them:
Increasing adoption and Optimizing performance of the system:
For example, salesforce team has launched a particular functionality in production to help sales reps complete a business activity easily and also streamline its data correctly. If the sales reps do not use the functionality to its full potential, organizations can spot and look into this problem.
Tracking performance/activities of reps:
Tracking the activity at an individual user is possible. Organizations can track activity such as 'No of times user logged in', 'Total time spent by users on system in a given time frame', etc. This helps business leaders to monitor, keep track of their sales reps activity and their performance.
Monitoring Data Loss
Imagine a sales representative quits organization and joins a significant rival. Your organization discovers a trend your rival organization winning business from your company. You have reason to believe that your former employee has stolen your organizations data and has been using it for the benefit of your rival. Event Monitoring can help you investigate and detect past user and also helps in prevent the repetition of such activity in future.
Increasing adoption and Optimizing performance of the system:
Here event monitoring comes into picture. The admin backend team, with the knowledge of all the components that have been delivered for the usage of sales reps, can identify eventtype from event log files and check how many users have used the components/functionality, and what is the system response time for different user for this functionality. Such learning cans be used in improving the functionality, better User experience, changes in UI and redevelopment, etc.
Based on time attributes available at logs, developers can identify what could be the causes effecting the usage, i.e., the network or a code level issue.
Tracking performance/activities of reps:
We can derive certain metrics out of log data based on multiple event types. For e.g., Find how many sessions an individual user had in given timeframe, Find the total number of activities and time taken for individual activity in a period, etc. The attributes for these are session_key, Timestampe_derived, DB_Total_Time etc.
Monitoring Data Loss:
Download the ReportExport log file. Open it in a spreadsheet, and analyze it. You can figure out how confidential information got stolen/leaked. For e.g., Lets assume the lead report’s ID is 00O30000008a3De. The URI field contains the ID of the report that was exported, and the USER_ID field contains the ID of the user who exported the report. This information helps you pinpoint the user that has misused the data.
Solution Details:
Here are the few metrics that will help us identify about the user performance/activities.
Total number of activities and total time spent by users:
Number of activities by object, and actions completed:
Number of activities as per day, hour, minutes:
To generate the above metrics we need data on hourly or daily basis for Event Monitoring. The data can be received by following ways:
There also are other ways to get data such as integrating Saleforce with external applications to stream this data.
You can find such options in below link:
https://trailhead.salesforce.com/content/learn/modules/event_monitoring/event_monitoring_download
In first phase to analyze the data of different event type log file and there attributes and generate the metrics out of it. We have exported the log files via ELF browser application.
https://www.salesforcehacker.com/2015/05/download-event-log-files-using-elf.html