Salesforce Forensics: Telemetry for Detection & Response

This report outlines how to investigate and monitor Salesforce for security incidents by leveraging native telemetry sources—Login History, Setup Audit Trail, Event Monitoring, Threat Detection, and Field History Tracking—along with their access tiers, retention limits, and delivery delays. It contextualizes these capabilities against SaaS-focused intrusions (e.g., Salesforce–Drift) and techniques like abusing multiple identity providers for persistence, offering practical guidance for correlating user activity, detecting anomalous data access, and building forensic timelines across Salesforce editions.