Map Anomalies to CSP Service Actions
Threat Protection tracks specific actions within your Sanctioned IT service. The following tables map the tracked actions against specific anomalies that may be generated if the actions exceed expected thresholds:
Salesforce
|
Service Action |
Associated Anomaly |
|---|---|
|
Administer |
Excessive Administration |
|
Assign Role/Sub Role |
Excessive Administration |
|
Create Business Hours |
Excessive Administration |
|
Create Delegated Administrators |
Excessive Administration |
|
Create Delegated Group |
Excessive Administration |
|
Create Login IP Range of Profile |
Excessive Administration |
|
Create Network Access Entry |
Excessive Administration |
|
Create Permission Set |
Excessive Administration |
|
Create Quick New Group |
Excessive Administration |
|
Create Role/Sub Role |
Excessive Administration |
|
Create Template |
Excessive Administration |
|
Create User Role |
Excessive Administration |
|
Create/Update Calendar Sharing |
Excessive Administration |
|
Create/Update Fiscal Year |
Excessive Administration |
|
Create/Update Sharing Rules |
Excessive Administration |
|
Delete Login IP Range of Profile |
Excessive Administration |
|
Delete Network Access Entry |
Excessive Administration |
|
Delete Permission Set |
Excessive Administration |
|
Delete Role/Sub Role |
Excessive Administration |
|
Download Setup Audit Trail |
Excessive Administration |
|
Edit Network Access Entry |
Excessive Administration |
|
Inline Delete Permission Sets |
Excessive Administration |
|
Manage Delegated Groups |
Excessive Administration |
|
Mass Delete |
Excessive Administration |
|
Remove Delegated Group |
Excessive Administration |
|
Update Business Hours |
Excessive Administration |
|
Update Chatter Email Settings |
Excessive Administration |
|
Update Chatter Feed Settings |
Excessive Administration |
|
Update Delegated Group |
Excessive Administration |
|
Update Grant Login Access |
Excessive Administration |
|
Update Group |
Excessive Administration |
|
Update Holiday |
Excessive Administration |
|
Update HTML Documents and Attachments Settings |
Excessive Administration |
|
Update Language Settings |
Excessive Administration |
|
Update Login IP Range of Profile |
Excessive Administration |
|
Update Permission Set |
Excessive Administration |
|
Update Role/Sub Role |
Excessive Administration |
|
Update Sharing Settings |
Excessive Administration |
|
Update User |
Excessive Administration |
|
Update User Role |
Excessive Administration |
|
Update/Delete Permission Sets |
Excessive Administration |
|
View Business Hours |
Excessive Administration |
|
View Delegated Group |
Excessive Administration |
|
View Holiday |
Excessive Administration |
|
View Network Access |
Excessive Administration |
|
View Permission Set |
Excessive Administration |
|
View Permission Sets |
Excessive Administration |
|
View Role |
Excessive Administration |
|
View User Role |
Excessive Administration |
|
Content Transfer |
Data Access |
|
Create Attachment |
Data Access |
|
Create Chatter Comment |
Data Access |
|
Create Chatter File |
Data Access |
|
Create Chatter File Post |
Data Access |
|
Create Chatter File Version |
Data Access |
|
Create Chatter Link |
Data Access |
|
Create Chatter Poll |
Data Access |
|
Create Chatter Text Post |
Data Access |
|
Create Content File Version |
Data Access |
|
Delete Chatter File |
Data Access |
|
Search Chatter Feed |
Data Access |
|
Create Account |
Data Access |
|
Create Attachment |
Data Access |
|
Create Contact |
Data Access |
|
Create Contract |
Data Access |
|
Create Lead |
Data Access |
|
Create Opportunity |
Data Access |
|
Create Quick New Contact |
Data Access |
|
Create Quick New Lead |
Data Access |
|
List Account |
Data Access |
|
List Contact |
Data Access |
|
List Contract |
Data Access |
|
List Opportunity |
Data Access |
|
Mini-Page Opportunity View |
Data Access |
|
Quick Create Account |
Data Access |
|
Quick Create Contact |
Data Access |
|
Quick Create Lead |
Data Access |
|
Quick Create Opportunity |
Data Access |
|
Transfer Contact Ownership |
Data Access |
|
Transfer Opportunity Ownership |
Data Access |
|
View Account |
Data Access |
|
View Accounts |
Data Access |
|
View Attached File |
Data Access |
|
View Attachment |
Data Access |
|
View Contact |
Data Access |
|
View Contacts |
Data Access |
|
View Contract |
Data Access |
|
View Contracts |
Data Access |
|
View Leads |
Data Access |
|
View Opportunities |
Data Access |
|
Delete Attachment |
Data Delete |
|
Delete Chatter Comment |
Data Delete |
|
Delete Chatter File Post |
Data Delete |
|
Delete Chatter Link |
Data Delete |
|
Delete Chatter Poll |
Data Delete |
|
Delete Chatter Text Post |
Data Delete |
|
Delete Content File |
Data Delete |
|
Delete Lightning Report |
Data Delete |
|
Delete Account |
Data Delete |
|
Delete Attachment |
Data Delete |
|
Delete Contact |
Data Delete |
|
Delete Contract |
Data Delete |
|
Delete Lead |
Data Delete |
|
Delete Opportunity |
Data Delete |
|
Deleted Contact From Account |
Data Delete |
|
Download Document Attachment |
Data Download |
|
Download Chatter File |
Data Download |
|
Export Report |
Data Download |
|
Document Updated |
Data Updates |
|
Update Lightning Report |
Data Updates |
|
Modify Attachment |
Data Updates |
|
Modify Chatter File Version |
Data Updates |
|
Report |
Report Execution |
|
Download Saved Report |
Service Usage |
|
Data Exported |
Service Usage |
|
Download Doc |
Service Usage |
|
Download File |
Service Usage |
|
Download Preview |
Service Usage |
|
Follow File to Receive Updates |
Service Usage |
|
Share File with People/Group |
Service Usage |
|
Update Account |
Service Usage |
|
Update Attachment |
Service Usage |
|
Update Contact |
Service Usage |
|
Update Contract |
Service Usage |
|
Update Lead |
Service Usage |
|
Update Opportunity |
Service Usage |
|
Send Email To Contact/Lead |
Service Usage |
|
Share File via Link |
Service Usage |
|
Download Ad-hoc Report |
Service Usage |
|
Update Report |
Service Usage |
|
Create Report |
Service Usage |
|
View Report |
Service Usage |
|
View Reports |
Service Usage |
|
Activity Reminder Page |
Service Usage |
|
Add Event to OutLook |
Service Usage |
|
All Tabs |
Service Usage |
|
App Home Page |
Service Usage |
|
Campaigns Home |
Service Usage |
|
Cases Home |
Service Usage |
|
Chatter Page |
Service Usage |
|
Contracts Home |
Service Usage |
|
Create Brand Template |
Service Usage |
|
Create Business Hours |
Service Usage |
|
Create Campaign |
Service Usage |
|
Create Case |
Service Usage |
|
Create Document |
Service Usage |
|
Create Email Template |
Service Usage |
|
Create Event |
Service Usage |
|
Create File |
Service Usage |
|
Create Folder |
Service Usage |
|
Create Folder in Documents |
Service Usage |
|
Create Group |
Service Usage |
|
Create Holiday |
Service Usage |
|
Create Letter Head |
Service Usage |
|
Create Mail Merge Template |
Service Usage |
|
Create Mail Merge Template |
Service Usage |
|
Create Meeting |
Service Usage |
|
Create New Event |
Service Usage |
|
Create New Profile |
Service Usage |
|
Create Product |
Service Usage |
|
Create Quick New Account |
Service Usage |
|
Create Quick New Case |
Service Usage |
|
Create Quick New Event |
Service Usage |
|
Create Quick New Note |
Service Usage |
|
Create Quick New Opportunity |
Service Usage |
|
Create Quick New Task |
Service Usage |
|
Create Solution |
Service Usage |
|
Create Task |
Service Usage |
|
Create/Update Document |
Service Usage |
|
Delete Brand Template |
Service Usage |
|
Delete Business Hours |
Service Usage |
|
Delete Calendar Sharing |
Service Usage |
|
Delete Campaign |
Service Usage |
|
Delete Case |
Service Usage |
|
Delete Content Document |
Service Usage |
|
Delete Delegated Group |
Service Usage |
|
Delete Document |
Service Usage |
|
Delete Email Template |
Service Usage |
|
Delete Event |
Service Usage |
|
Delete Folder |
Service Usage |
|
Delete Folder in Documents |
Service Usage |
|
Delete Group |
Service Usage |
|
Delete Holiday |
Service Usage |
|
Delete Letter Head |
Service Usage |
|
Delete Mail Merge Template |
Service Usage |
|
Delete Mail merge Template |
Service Usage |
|
Delete Product |
Service Usage |
|
Delete Product2 |
Service Usage |
|
Delete Profile |
Service Usage |
|
Delete Report |
Service Usage |
|
Delete Solution |
Service Usage |
|
Delete Task |
Service Usage |
|
Delete Template |
Service Usage |
|
Delete User Role |
Service Usage |
|
Documents Home |
Service Usage |
|
Holidays |
Service Usage |
|
Inline Update of Event/Task |
Service Usage |
|
Insufficient Privileges |
Service Usage |
|
Lead Converted |
Service Usage |
|
List Campaign |
Service Usage |
|
List Case |
Service Usage |
|
List Lead |
Service Usage |
|
Logout |
Service Usage |
|
Mini-Page Account View |
Service Usage |
|
Mini-Page Campaign View |
Service Usage |
|
Mini-Page Case View |
Service Usage |
|
Mini-Page Contact View |
Service Usage |
|
Mini-Page Lead View |
Service Usage |
|
Mini-Page Product View |
Service Usage |
|
Mini-Page Solution View |
Service Usage |
|
Name |
Service Usage |
|
Post to Chatter Feed |
Service Usage |
|
Print Account View |
Service Usage |
|
Print Campaign View |
Service Usage |
|
Print Case View |
Service Usage |
|
Print Contact View |
Service Usage |
|
Print Lead View |
Service Usage |
|
Print Opportunity View |
Service Usage |
|
Print Product View |
Service Usage |
|
Print Solution View |
Service Usage |
|
Products Home |
Service Usage |
|
Recently Viewed Files |
Service Usage |
|
Recycle Bin |
Service Usage |
|
Solutions Home Page |
Service Usage |
|
Stop Following File |
Service Usage |
|
Transfer Account Ownership |
Service Usage |
|
Transfer Campaign Ownership |
Service Usage |
|
Transfer Case Ownership |
Service Usage |
|
Transfer Lead Ownership |
Service Usage |
|
Understanding Letterheads |
Service Usage |
|
Unfiled Public Email Templates |
Service Usage |
|
Update Brand Template |
Service Usage |
|
Update Business Hours |
Service Usage |
|
Update Campaign |
Service Usage |
|
Update Case |
Service Usage |
|
Update Company Information |
Service Usage |
|
Update Content Document |
Service Usage |
|
Update Document |
Service Usage |
|
Update Email Template |
Service Usage |
|
Update Event |
Service Usage |
|
Update Folder |
Service Usage |
|
Update Folder in Documents |
Service Usage |
|
Update Letter Head |
Service Usage |
|
Update Mail Merge Template |
Service Usage |
|
Update Mail merge Template |
Service Usage |
|
Update Mass Addresses |
Service Usage |
|
Update Product |
Service Usage |
|
Update Product |
Service Usage |
|
Update Profile |
Service Usage |
|
Update Solution |
Service Usage |
|
Update Task |
Service Usage |
|
Update Template |
Service Usage |
|
Update/Close Task |
Service Usage |
|
Uri |
Service Usage |
|
URL No Longer Exists |
Service Usage |
|
View Brand Template |
Service Usage |
|
View Campaign |
Service Usage |
|
View Campaigns |
Service Usage |
|
View Case |
Service Usage |
|
View Cases |
Service Usage |
|
View Content Document |
Service Usage |
|
View Document |
Service Usage |
|
View Documents |
Service Usage |
|
View Email Template |
Service Usage |
|
View Event |
Service Usage |
|
View Files |
Service Usage |
|
View Folder |
Service Usage |
|
View Lead |
Service Usage |
|
View Mail merge Template |
Service Usage |
|
View Mail Merge Templates |
Service Usage |
|
View Opportunity |
Service Usage |
|
View Products |
Service Usage |
|
View Profile |
Service Usage |
|
View Solution |
Service Usage |
|
View Solutions |
Service Usage |
|
View Task |
Service Usage |
|
View Tasks |
Service Usage |
|
View Template |
Service Usage |
|
View User |
Service Usage |
|
View User Detail |
Service Usage |
|
View/Update Meeting |
Service Usage |
|
Login |
Login Success |
|
Create User |
User Account Creation |
|
Delete User |
User Account Deletion |
Box
|
Service Action |
Associated Anomaly |
|---|---|
|
Agree Terms |
Excessive Administration |
|
Create Group |
Excessive Administration |
|
Delete Group |
Excessive Administration |
|
Disable Shared Links |
Excessive Administration |
|
Edit Group |
Excessive Administration |
|
Edit User |
Excessive Administration |
|
Group Add User |
Excessive Administration |
|
Group Remove User |
Excessive Administration |
|
Reject Terms |
Excessive Administration |
|
Copy Folder |
Data Access |
|
Delete Folder |
Data Access |
|
Move Folder |
Data Access |
|
Delete File |
Data Delete |
|
Download File |
Data Download |
|
Download Folder |
Data Download |
|
Copy File |
Data Sharing |
|
Share Folder |
Data Sharing |
|
Invite Collaborators |
Data Sharing |
|
Update Collaboration Expiration |
Data Sharing |
|
WebDoc Shared |
Data Sharing |
|
Add File Comment |
Data Updates |
|
Add Tag |
Data Updates |
|
Change Folder Name |
Data Updates |
|
Restore Folder from Trash |
Data Updates |
|
Upload Folder |
data upload |
|
Upload File |
Data Upload |
|
Disable Shared Links for Folder |
External Data Sharing |
|
Update Shared Links |
External Data Sharing |
|
Update Shared Links Expiration |
External Data Sharing |
|
Accept Collaboration Accepted |
Service Usage |
|
Add Device Association |
Service Usage |
|
Change Collaboration Role |
Service Usage |
|
Change File Name |
Service Usage |
|
Change File Name |
Service Usage |
|
Create Folder |
Service Usage |
|
Delete File/Folder |
Service Usage |
|
Edit |
Service Usage |
|
Expire Collaboration |
Service Usage |
|
Expire Shared Links |
Service Usage |
|
Expire Storage |
Service Usage |
|
Group Add Folder |
Service Usage |
|
Group Remove Folder |
Service Usage |
|
Locked |
Service Usage |
|
Logout |
Service Usage |
|
Move File |
Service Usage |
|
Preview |
Service Usage |
|
Refresh OAuth Token |
Service Usage |
|
Remove Collaboration |
Service Usage |
|
Remove Device Association |
Service Usage |
|
Restore File from Trash |
Service Usage |
|
Sync Folder |
Service Usage |
|
Unlocked |
Service Usage |
|
Unsync Folder |
Service Usage |
|
View Updates Section |
Service Usage |
|
View User Profile |
Service Usage |
|
Login Failure |
Login Failure |
|
Login Admin |
Login Success |
|
Login |
Login Success |
|
Create User |
User Account Creation |
|
Delete User |
User Account Deletion |
O365/SharePoint/OneDrive
|
Service Action |
Associated Anomaly |
|
Add Exempt User Agent |
Excessive Administration |
|
Add Site Collection Admin |
Excessive Administration |
|
Add User to Group |
Excessive Administration |
|
Allow User to Create Groups |
Excessive Administration |
|
Change Exempt User Agents |
Excessive Administration |
|
Create Group |
Excessive Administration |
|
Create Site Collection |
Excessive Administration |
|
Delete Group |
Excessive Administration |
|
Deny Computer from Syncing Files |
Excessive Administration |
|
Enable Document Preview |
Excessive Administration |
|
Enable Legacy Workflow |
Excessive Administration |
|
Enable Office On-Demand |
Excessive Administration |
|
Enable Result Source for People Searches |
Excessive Administration |
|
Enable RSS feeds |
Excessive Administration |
|
Modify Site Permissions |
Excessive Administration |
|
Remove User from Group |
Excessive Administration |
|
Rename Site |
Excessive Administration |
|
Request Site Admin Permissions |
Excessive Administration |
|
Set Host Site |
Excessive Administration |
|
Update Group |
Excessive Administration |
|
Create Contact |
Data Access |
|
Move File |
Data Access |
|
Delete File |
Data Delete |
|
Allow Computer to Sync Files |
Data Download |
|
Download File |
Data Download |
|
Download Files to Computer |
Data Download |
|
Invite Collaboration |
Data Sharing |
|
Accept Invitation |
Data Sharing |
|
Approve Access Request |
Data Sharing |
|
Create Access Request |
Data Sharing |
|
Create Invitation |
Data Sharing |
|
Re-Send Invitation |
Data Sharing |
|
Share File or Folder |
Data Sharing |
|
Unshare File or Folder |
Data Sharing |
|
Modify File |
Data Updates |
|
Rename File |
Data Updates |
|
Upload File |
Data Upload |
|
Create Sharing Link |
External Data Sharing |
|
Disable Sharing Link |
External Data Sharing |
|
Share File or Folder with External User |
External Data Sharing |
|
Access File |
Service Usage |
|
Check-In File |
Service Usage |
|
Check-Out File |
Service Usage |
|
Copy File |
Service Usage |
|
Create Send To Connection |
Service Usage |
|
Decline Access Request |
Service Usage |
|
Delete Send To Connection |
Service Usage |
|
Discard File Checkout |
Service Usage |
|
Download File Changes to Computer |
Service Usage |
|
Expire Access Request |
Service Usage |
|
Expire Invitation |
Service Usage |
|
Logout |
Service Usage |
|
Sync File Changes |
Service Usage |
|
Update Shared |
Service Usage |
|
Upload File changes to document library |
Service Usage |
|
Upload Files to document library |
Service Usage |
|
View File |
Service Usage |
|
Withdraw Invitation |
Service Usage |
|
Login |
Login Success |
O365 Azure AD
|
Service Action |
Associated Anomaly |
|---|---|
|
Add Service Principal |
Excessive Administration |
|
Set DirSyncEnabled Flag |
Excessive Administration |
|
Update User |
Excessive Administration |
|
Set Company Information |
Excessive Administration |
|
Change User Password |
Excessive Administration |
|
Reset User Password |
Excessive Administration |
|
Add Group |
Excessive Administration |
|
Update Group |
Excessive Administration |
|
Delete Group |
Excessive Administration |
|
Add Member to Group |
Excessive Administration |
|
Remove Member from Group |
Excessive Administration |
|
Batch Invites Uploaded |
Excessive Administration |
|
Add Verified Domain |
Excessive Administration |
|
Remove Owner from Group |
Excessive Administration |
|
Invite External User |
External Data Sharing |
|
Add User |
User Account Creation |
|
Add Owner to Group |
User Account Creation |
|
Delete User |
User Account Deletion |