Transaction Security is a feature in Salesforce that monitors events in real-time to detect potential issues based on predefined rules. It allows you to create policies that include events, notifications, and actions. An event is any occurrence in Salesforce, such as user clicks, changes to record states, or value measurements. Events are immutable and timestamped. This article discusses about Enhanced Transaction Security in Salesforce.
To create a Transaction Security policy, you start by selecting a transaction, or event, to monitor. Next, you define the actions that should be triggered when the event occurs. These rules and actions together form a policy. Transaction Security policies can be tailored for various scenarios, and you can extend their functionality using Apex for more customized protection.
Use case
For example, allowing users to export reports with too many records can pose a security risk. Imagine someone exports 1,000 records into an Excel sheet on their desktop, where Salesforce can no longer secure it. The user could then sync that file to another system, email it, or store it on a USB drive that’s easily lost.
To prevent users from downloading large volumes of data from a report, you need to create a policy for the Report Event. This policy might specify that the action should be blocked when users attempt to export more than 1,000 rows. Additionally, you can set it up to notify you if this event occurs.
Your Salesforce employees need to view reports and export data. For security purposes, you want to ensure they aren’t exporting large amounts of data from reports. This helps reduce the risk of leaking sensitive, competitive, or proprietary information. You can use Condition Builder to easily create a policy with clicks that automatically blocks report exports when a report includes a large volume of records.
Here are some of the available event types for Transaction Security policies:
- API Event: Monitors and protects all API queries, preventing unauthorized data exports.
- List View Event: Tracks user access to list views from both the UI and API queries.
- Login Event: Monitors login details, blocking logins from untrusted locations, unsupported browsers, and specific device types.
- Report Event: Monitors report views and exports, blocking access or requiring multi-factor authentication for sensitive information, or sending notifications when reports are run or exported.
You can choose the actions to take if the policy is triggered:
- Block the operation.
- Require multi-factor authentication for higher security.
- Do nothing (useful for testing purposes).
- Opt-in for policy notifications, which can be sent via:
- In-app notification to the Salesforce app
- Both email and in-app notifications
How to create a transaction security policy
- Navigate to Setup
- Type Transaction Security in the Quick find box
- Click Transaction Security Policies
- Click ‘Enable’
Click ‘New’
To create a policy, there are two options-Condition builder and Apex. Condition Builder is used to create the policy with just clicks. Apex is used for more complex use cases.
- Click Next. The page to define your policy conditions appears.
- Select the Event type and specify conditions.
- Specify what actions to be taken if a user attempts to export more than 10 records at a time.
- Mark the status as Enabled.
- Click Finish.
To learn more, click Enhanced Transaction Security (salesforce.com)
Take Five Consulting is a technology company, based in Virginia U.S., that specializes in the Mortgage Banking vertical especially LOS implementation and application development. Take Five Consulting creates and implement mortgage technology and software specifically for Mortgage Industry.
