Event Monitoring.
All posts.
SalesBleed: How a Web-to-Lead Form Got Agentforce to Leak CRM Data, and What to Change in Your Org
SalesBleed slipped past the Trusted URL fix from ForcedLeak and used Slack link previews to leak CRM data. How it worked and what Agentforce settings to change.
Salesforce Guest User Anomaly Fired: Scanner, Tester, or Data Leaving? Investigate It with sf audit incident
A Salesforce Guest User Anomaly fired. Scanner, tester, or data leaving? How sf audit incident turns the alert into a cited, defensible verdict, offline.
Salesforce Attack Chain Correlation: Five New Chains and the Blind Spot That Hid Them
sf-audit's attack chain model could not see half its own checks. Fixing the capability grants unlocked five new Salesforce attack chains, taking it to sixteen.
The Salesforce Data Theft Campaigns, 2025 to 2026: A Verified Timeline and the Audit That Covers All of Them
Four campaigns, three ways in, none a platform bug. The dates and actor names checked against primary sources, plus the audit that covers all three routes.
Why Filtering Salesforce Event Logs by IP Misses Most of the Incident
Salesforce splits one actor's activity across event types with different identifying fields. Why IP filtering misses the SOQL, and how to correlate safely.
Salesforce Report-Export Step-Up Enforcement: The Known Issues and Gotchas Nobody Warned You About
Blocked exports, a broken Login As, and RPA jobs failing: the practitioner known issues behind Salesforce report-export step-up enforcement in July 2026.
A Guest IP Got Flagged for Log4j: Scanner or Breach? Triage Salesforce EventLogFile in One Command
A guest Experience Cloud IP is flagged for Log4j exploitation. Scanner or real attacker? How to tell it apart from your EventLogFile logs, in one command.
Agentforce Agent User Least Privilege: What the Wizard Grants, What Your Agent Actually Needs, and How to Audit the Gap
What the Agentforce setup wizard grants your service agent user, what it actually needs, and how to audit both before an attacker maps the gap for you.
Post-ForcedLeak: Hardening Agentforce Against Prompt Injection (The Setup Steps Nobody Published)
ForcedLeak turned a $5 domain into an Agentforce data-exfiltration channel. The concrete Setup hardening steps to shrink your prompt-injection blast radius.
Free Salesforce Event Monitoring: Build a Security Baseline from EventLogFile Without Shield
Salesforce gives Enterprise, Unlimited and Performance orgs free EventLogFile logs, but only for a day. How to capture them into a baseline without Shield.