0

One of the 30+ EventTypes that can be queryed via the EventLogFile is 'ReportExport'. This queries the instances in an EventLogFile in which a user exported a report.

The raw response from a GET call via the Workbench REST Explorer returns, amongst other things, the user Id and the report Id: https://trailhead.salesforce.com/en/event_monitoring/event_monitoring_query.

However, what if the person who exported the data didn't save the report, hence no report Id would be seen in the raw response? Someone could create a report on the fly, and then simply export the data. That would, I suppose, show that the user did export a report but it won't show what they exported since the report wasn't saved in the first place.

What is best practice to deal with this? It seems that to be completely water-tight, users should not have the autonomy to create reports but rather would have to use pre-defined reports, such that every 'ReportExport' log would always have a corresponding report Id?

1 Answer 1

0

I followed this up with both Premier Support and the previous product manager of Event Monitoring, one Adam Torman who is a author of the excellent blog Salesforce Hacker.

If someone creates a report, exports it, and then doesn't save it, the raw response returns a report URL of /00O to indicate that there wasn't a persisted report Id.

No parameters are returned in the response. It is just '/00O' and the User Id.

This is, in my opinion, a blind spot because how could one prove that the User exported particularly sensitive data or not? The only proof is that the User exported some data at a time/date but no evidence of what the exact data was.

The way I see to make this water-tight is to remove the 'Create' and 'Delete' Report rights for Salesforce users in the org, and to have a force.com site / email2case process setup such that Users request report creation from there to standardise report creation by SysAdmins.

In addition, an internal process to ensure that no report gets deleted (or at least to archive reports before they are deleted and store them in a Salesforce Library) would be preferential because if in the near future, if a report gets deleted but from the Event Log you can see that someone exported it, you won't be able to see 100% what was exported. The parameters are referenced in the raw response but only the value of the fields and not both the values and fields. For example, if the record type was 'New Opportunities' on a report, the raw response would say pv1='New+Opportunities' but there won't be a reference to 'Record Type'.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .