Skip to main content

Event Monitoring

Event monitoring is used to keep track of logins, logoutw, web clicks, API calls, VF page loads, apex executions and reporte exports.

All these events are stored in event log files.

Each org's event log files are stored in API object called EventLog File.


Labels:

Comments

Post a Comment

Popular posts from this blog

Cross-Site Request Forgery (CSRF)

CSRF occurs when an attacker's webpage contains URL that performs action on website. Suppose the user is logged into a webpage and they visit an attacker's webpage simultaneously, the URL is retrieved by the attacker and actions are performed. (Hence it is advisable to log out first before opening other websites.) In Lightning platform, Salesforce has implemented an anti-CSRF token to prevent this attack. It uses tokens for authentication. Suggestions for best practices:  Add a confirmation page/pop up before action. Shorten the idle session timeout. Logout of active session and not use browser to visit other sites while authenticated. In Salesforce, built-in defence against CSRF is present. If user is logged in on one tab and attempts in another, they will see this error: "The page you submitted was invalid for your session." However, users can log in by refreshing the login page or attempting to log in a second time.
Post a Comment
Read more

SOQL Injection

SOQL injection attack occurs when a user inputs a value in dynamic SOQL query. If that input is not validated, the command(input) can modify the SOQL statement. Best practices to avoid SOQL injection attack: Avoid using dynamic SOQL queries. Use static queries and binding variables. In case of dynamic SOQL queries, use escapeSingleQuotes method to sanitize the user-supplied input.
Post a Comment
Read more