Automate Proactive Responses with Flow
Learning Objectives
After completing this unit, you’ll be able to:
- Describe how platform event-triggered flows extend Transaction Security policies.
- Explain how Real-Time Event Monitoring enables automated security responses.
- Identify which automation pattern fits different security scenarios.
From Blocking to Orchestrating
In Unit 3, you learned how Transaction Security policies can block risky actions in real time. But blocking is only half of the security response. Your security team also needs to know when a policy fires so they can investigate, follow up with the user, or escalate to incident response.
This is where Platform Event-Triggered Flows and Real-Time Event Monitoring come together. When a Transaction Security policy is triggered, it publishes an event to a real-time stream. You can subscribe to that stream with a Flow that automatically notifies your security team, creates a case, or even triggers additional security checks.
Think of it as a two-stage defense.
- Transaction Security policy: The guardrail that blocks the action.
- Platform event-triggered flow: The alarm system that alerts your team.
Platform Event-Triggered Flows for Security
A Platform Event-Triggered Flow listens to event streams published by Salesforce. Unlike Record-Triggered Flows, which fire when a record changes, Platform Event-Triggered Flows respond to system-level events like:
- A Transaction Security policy blocking a suspicious report export
- A user logging in from an unusual location
- An API client exceeding rate limits
The flow receives the event data (who triggered it, what happened, when it occurred) and takes action based on the conditions you define.
Flow Type | Trigger | Latency | Example Use Case |
|---|---|---|---|
Record-Triggered | A Salesforce record changes | Immediate | Alert when a user’s profile is changed to System Administrator. |
Platform Event-Triggered | A system event occurs | Near real-time | Alert when a Transaction Security policy blocks a report export. |
Scheduled | Time-based trigger | Minutes to hours | Daily summary of all blocked export attempts. |
Some of the most useful security automations for admins are straightforward record changes:
Trigger Condition | Automated Action |
|---|---|
User deactivated (IsActive = | Alert the security team to verify offboarding is complete. |
User profile changed to System Administrator | Send an email for security review. |
Permission set containing “Modify All Data” assigned | Open a case for review. |
Real-Time Event Monitoring Streams
Real-Time Event Monitoring (RTEM) publishes security events to live streams the moment they occur. You can subscribe to these streams using Platform Event-Triggered Flows, which let you build automated responses without code. To make an event stream available to Flow, you enable it in the Event Manager in Setup.
Not all real-time event types are available to Flow. Some require the Pub/Sub API, a developer tool used to connect external security systems. Check the Real-Time Event Monitoring Objects documentation for the current list of supported subscribers per event type.
Key event streams for security automation include the following.
Event Stream | What It Captures | Security Value | Automation Use Case |
|---|---|---|---|
API Event Stream | API calls and responses | Integration abuse detection | Flag when an integration exceeds normal call volume. |
Report Event Stream | Report views, exports, and runs | Data exfiltration detection | Alert when a user exports more than 2,000 records. |
Login Event Stream | Login attempts and outcomes | Suspicious login monitoring | Track login patterns and flag anomalies. |
Login As Event Stream | Admin impersonation events | Admin activity tracking | Notify the security team when an admin uses Login As. |
Logout Event Stream | User session endings | Session duration monitoring | Calculate total session duration for compliance. |
List View Event Stream | List views accessed | Bulk record viewing detection | Detect mass viewing of sensitive objects. |
Permission Set Event Stream | Permission changes | Privilege escalation detection | Alert when elevated permissions are assigned. |
Credential Stuffing Event | Automated login attacks detected by ML | Identity attack detection | Trigger immediate lockdown procedures. |
Session Hijacking Event | Session taken over by unauthorized party | Session security | Force session termination and MFA. |
Report Anomaly Event | Unusual export behavior vs. 90-day baseline | Data exfiltration anomaly | Escalate for investigation. |
API Anomaly Event | Unusual API behavior vs. user’s history | Integration abuse anomaly | Flag for review. |
Choosing Your Automation Strategy
Not every security event needs the same response. Here’s how to decide which automation pattern to use:
If You Need… | Use This | Why |
|---|---|---|
Instant blocking | Transaction Security policy only | Prevents the action before it completes. |
Block + notify | Transaction Security policy and Platform Event-Triggered Flow | Stops the threat and alerts your team. |
Notify only | Platform Event-Triggered Flow subscribed to event stream | Useful for awareness without disrupting work. |
Delayed investigation | Record-Triggered Flow and Event Log File Browser | Good for lower-priority events that can wait. |
Send a Slack Alert When A Report Export Is Blocked
In Unit 3, Fatima built a Transaction Security policy that blocks contract queries from IP addresses outside of company property. Now she wants her security team to receive instant Slack notifications whenever the policy fires, so they can follow up with the user and understand why they tried to access sensitive data outside of work.
Real-Time Event Monitoring requires a paid add-on license and is not available in a standard Trailhead Playground. The next example demonstrates the concepts and workflow. To implement this in a production org, contact your Salesforce account executive to learn more about RTEM and Salesforce Shield.
Here’s what Fatima configures.
- Enable the event stream. In Event Manager, Fatima enables streaming for the Report Event Stream. This is the same Event Manager she configured earlier, she’s simply adding one more event type to the streaming pipeline.
- Create a Platform Event-Triggered Flow. In Flow Builder, she selects Platform Event-Triggered Flow and chooses Report Event Stream as the trigger. Every time a report event publishes this Flow receives it.
- Filter for blocked events only. Fatima adds a decision element that checks whether a Transaction Security Policy ID is present (meaning a policy evaluated this event) and whether the outcome was a block. Only blocked exports continue down the alert path.
- Send the Slack message. Down the blocked path, she adds a Send Slack Message action targeting her security team’s channel. The message includes context pulled directly from the event: who triggered it, which contract they tried to access, the IP address they used, and when it happened.
Now, whenever the Transaction Security policy blocks a suspicious contract query, the security team receives an instant Slack notification. This means they can respond within minutes instead of discovering the incident hours later when reviewing logs. If the action was legitimate, they can quickly grant a one-time exception. If it looks suspicious, they can escalate immediately.