Salesforce Publishes Forensic Guide After Series of Cyberattacks

Salesforce has published a forensic investigation guide aimed at helping organisations detect, analyse, and remediate security incidents within their Salesforce environments. The guide distils best practices across three core areas—activity logs, user permissions, and backup data—to answer questions such as what a specific user did during a given time and what data was impacted.

It highlights that every incident is unique and encourages tailoring investigations to context, while offering a starting framework that emphasises key components such as Login History and the Setup Audit Trail to reveal unusual activity.

For organisations using Salesforce Shield, enhanced visibility via Event Monitoring is noted, with additional coverage for B2C Commerce Cloud through specialised shopping logs, and the Who Sees What Explorer in Security Center helping admins determine export or configuration privileges.

The guidance also covers back-up data comparison, real-time log analysis via Real-Time Event Monitoring for up to six months, and Automated transaction security policies that can block risky activities or trigger alerts, including a Guest User Anomaly alert that can halt access and reveal the attack IP. Published on 1 September 2025, the guide is presented as a practical resource to strengthen resilience across Salesforce deployments, according to Salesforce.