Learn the Core Concepts of Event Monitoring

Learning Objectives

After completing this unit, you’ll be able to:

• Distinguish between event monitoring as a practice, the Salesforce product, and the data.
  
• Describe the technical architecture of an event log file.
  

Practice, Product, and Data

For many Salesforce administrators, security has historically felt like a series of blind spots. While you can see that a user logged in, how do you know which sensitive records they viewed, or if they exported a client list before leaving the company? If you’ve ever wished you had a search history for every action taken in your Salesforce org, you’re thinking about event monitoring.

It’s important to distinguish between three terms that are often used interchangeably.

• Event monitoring (the security practice): This is the operational mindset of continuously observing user activity to identify risks, tune performance, and drive adoption. Event monitoring isn’t something to set up once and forget; it works best as an ongoing practice.
  
• Salesforce Event Monitoring (the product): This is the specific Salesforce toolset, typically part of Salesforce Shield, that gives you the technical ability to see the data behind how users and integrations interact with Salesforce.
  
• Event logs (the data): These are the raw logs generated by the system that tell you what happened, who did it, and when. Event Monitoring offers multiple event types, each with their own format.
  

A security analyst who says, “We need to start event monitoring,” might mean the practice. An IT director who says, “We already purchased Event Monitoring,” is talking about the product. And neither one is useful without understanding the event monitoring data: which format to use, what’s included, and where to find it.

The Technical Architecture of Events

Every user interaction, from report exports to API calls, is an event that generates a transaction record. These records are packaged into event logs. The baseline Event Monitoring log is the EventLogFile, a standard object which captures information about a range of event types. Event log files are captured daily. While all Salesforce customers can access a core set of daily event log file types for free, customers who purchase Salesforce Shield and Event Monitoring can access a wider range of event types and hourly event logs.

The Four Formats of Event Data

Event log files are the foundation of Event Monitoring, but Salesforce delivers event data in four formats, and each is designed for a different purpose. This badge focuses on the low-code tools, so here’s what you encounter as you work through each unit.

The Low-Code Path to Event Monitoring

Historically, event monitoring was the domain of advanced developers who wrote complex API scripts and used external tools like Splunk or Python to make sense of logs. While those advanced features still exist for enterprise security teams, this badge focuses on the low-code path.

The most powerful monitoring features are accessible directly in Setup and Flow Builder, and Salesforce provides prebuilt dashboards in CRM Analytics for visualizing your event data. This means you don’t need a background in data science to protect your org. We focus on easy-to-use, native features like the Setup-based Event Log File (ELF) Browser, one-click policy templates, and automated remediation using Flow.

The Salesforce Shield Context

Event Monitoring is a core component of Salesforce Shield, a suite of security tools that also includes Shield Platform Encryption, Field Audit Trail, and Data Detect.

Not all Event Monitoring features require a paid license. A core set of event types, including Login, Logout, and Apex Unexpected Exception events, are available in Enterprise, Unlimited, and Developer Editions at no additional cost. These are a solid starting point for basic activity tracking and security monitoring.

A full Event Monitoring or Shield license unlocks access to over 70 event types (including ReportExport, API calls, and Apex executions), hourly log generation, and up to 30 days of historical data storage.

Event Log Objects deserve special mention: unlike file-based ELFs, ELOs are queryable with SOQL and power native dashboards in Analytics Studio. When you enable ELOs, you gain immediate access to 30 days of historical data, even if you just turned on Event Monitoring. This makes ELOs ideal for both real-time investigation and building trend reports.

Event Log Objects, Real-Time Event Monitoring, and Threat Detection require additional licenses beyond the base Event Monitoring license. Contact your Salesforce account team to explore licensing options for your production org.

See Event Monitoring in Action

Let’s follow along as Fatima Daniels, the admin for Alpine Group, transitions from basic administration to advanced security oversight using low-code, native Salesforce tools.

Fatima meets with Ava Shah, the senior director of Finance, who is concerned. “I need to know what’s happening in this system,” Ava says. “Standard logs tell me who logged in, but not what they did once they were in.” Fatima knows that this is exactly what Event Monitoring is for, so her first step is to get the org set up to start collecting data.

Now that you understand the fundamentals, let’s get Fatima’s org ready.

• From Setup, in the Quick Find box, enter Event Monitoring and select Event Monitoring Settings.
  
• Locate the setting Generate event log files and click the toggle to turn it On.
  

Next, Fatima navigates to the Event Manager, which is the central control panel for streaming and storage of real-time events. This is the one-time setup step that unlocks everything else in Event Monitoring.

1. From Setup, in the Quick Find box, enter and select Event Manager.
   
2. Click the name of the event type that you want to edit.
   
3. Use the Update Event dropdown menu to select Enable Streaming and Enable Storage.
   

These features publish events to a live stream that Flow and external tools can subscribe to, and save events as queryable big objects for historical analysis.

For now, Fatima enables streaming and storage for the Login Event and Report Event—two high-value events that will power both her dashboards and her future Transaction Security policies. She can always enable additional event types later as her security practice matures.

Remember that until you enable an event type in Event Manager, that event won’t appear in real-time streams or big object storage, even if you have the license. Think of Event Manager as the master switch for each event type.

Resources

• Trailhead: Event Monitoring
• Trailhead: Real-Time Event Monitoring
• Trailhead: Event Log Objects: Quick Look
• Salesforce Help: Event Monitoring
• Salesforce Help: EventLogFile Object
• Salesforce Developers: EventLogFile Supported Event Types