{"id":794,"date":"2026-07-16T09:00:00","date_gmt":"2026-07-16T03:30:00","guid":{"rendered":"https:\/\/swapnilzambare.com\/blog\/salesforce-event-monitoring-login-history\/"},"modified":"2026-07-16T09:00:00","modified_gmt":"2026-07-16T03:30:00","slug":"salesforce-event-monitoring-login-history","status":"publish","type":"post","link":"https:\/\/swapnilzambare.com\/blog\/salesforce-event-monitoring-login-history\/","title":{"rendered":"Salesforce Event Monitoring and Login History"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Salesforce Event Monitoring records detailed activity in your org, such as logins, report exports, page views and API calls, in downloadable event log files. Together with Login History, it answers the security question every admin hears one day: &#8220;who did what, and when?&#8221;. In our <a href=\"https:\/\/swapnilzambare.com\/blog\/salesforce-org-security-mfa-login\/\">org security guide<\/a>, you set up MFA, login policies and Health Check. In our <a href=\"https:\/\/swapnilzambare.com\/blog\/salesforce-field-history-tracking-audit-trail\/\">field history guide<\/a>, you tracked changes to records and Setup. This post covers user activity.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this post, you will learn what Login History shows, what event log files contain, which events are free and which need an add-on, and how to read the logs. Then you will investigate a suspicious report export at Bright Path Tutors. You will also query event logs with SOQL, which developers and security teams use every day.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is Salesforce Event Monitoring?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Event Monitoring is a Salesforce feature that writes event log files about user actions. Each file covers one event type, such as Login, Report Export or API, for one day or one hour. Each row in the file is one action, with the user, time, IP address and details.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Login History is a simpler Setup page. It lists recent login attempts for your org, with the user, time, status, browser and location.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here is a simple analogy. Think of a building with a visitor register at the gate and CCTV inside. The register shows who came in and when, which is Login History. The cameras show what they did inside, which is Event Monitoring. Security teams need both to tell the full story.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why Salesforce Event Monitoring Matters<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Data leaks often start with normal-looking actions, like a large report export. However, without logs, you cannot prove what happened or who did it. As a result, teams either blame the wrong person or miss the real problem. So good logs protect honest users too, because they show clearly who did not take the data.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here are some real situations at Bright Path Tutors.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A sales rep who is leaving the company exports the full student list.<\/li>\n\n<li>Someone logs in from an unknown country at 3 AM.<\/li>\n\n<li>An integration suddenly makes ten times more API calls than usual.<\/li>\n\n<li>Auditors ask for proof of who viewed fee records last quarter.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">So these tools help you spot risky activity and answer audits with facts.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How Salesforce Event Monitoring Works<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The process has four steps. First, users work in Salesforce as normal, and each action creates an event. Next, Salesforce collects the events and writes log files, usually daily, for each event type. Then admins open the files with the Event Log File Browser in Setup, or query the EventLogFile object. Finally, you review the data in a spreadsheet or analytics tool, and act on anything suspicious.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-large\"><a href=\"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/10\/salesforce-event-monitoring-login-history-diagram-1.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"640\" src=\"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/10\/salesforce-event-monitoring-login-history-diagram-1-1024x640.png\" alt=\"Salesforce Event Monitoring diagram showing user actions becoming log files that admins review\" class=\"wp-image-720\" srcset=\"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/10\/salesforce-event-monitoring-login-history-diagram-1-1024x640.png 1024w, https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/10\/salesforce-event-monitoring-login-history-diagram-1-300x188.png 300w, https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/10\/salesforce-event-monitoring-login-history-diagram-1-768x480.png 768w, https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/10\/salesforce-event-monitoring-login-history-diagram-1-1536x960.png 1536w, https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/10\/salesforce-event-monitoring-login-history-diagram-1-2048x1280.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><figcaption class=\"wp-element-caption\">How Salesforce Event Monitoring works: user actions create events, Salesforce writes log files, admins browse or query them and act.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Login History works more simply. You open the page in Setup, filter it, and download the list as a file. So start there for any login question, because it needs no add-on and no query. Then move to event files when you need to know what happened after the login.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Key Parts of Salesforce Event Monitoring<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Login History<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">First, the Login History page shows recent logins for the org. It includes failed attempts, which help you spot password guessing. It also shows the login type, such as browser, mobile app or API, so you can tell people from integrations. You can create list views by user or status, and download the data as a CSV file.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Free event types<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Next, every org gets a small set of event types at no extra cost, such as Login and Logout. These files are kept for a short time, so download them if you need them later.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The Event Monitoring add-on<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Then the paid add-on, part of Salesforce Shield, adds many more event types. They include Report Export, URI page views, API calls and Lightning page views. It also keeps files longer and adds real-time monitoring options.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The Event Log File Browser<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Event Log File Browser in Setup lists available log files. You filter by event type and date, then download a file. It is the easiest way for admins to start.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Transaction Security policies<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Finally, with the add-on, Transaction Security policies can act in real time. For example, a policy can block a report export over 10,000 rows, or ask for MFA again.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The table below shows the events we will use in our investigation.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Event type<\/th><th>Records<\/th><th>Typical question<\/th><\/tr><\/thead><tbody><tr><td>Login<\/td><td>Every login attempt<\/td><td>Who logged in, from where?<\/td><\/tr><tr><td>Logout<\/td><td>Every logout<\/td><td>How long was the session?<\/td><\/tr><tr><td>Report Export<\/td><td>Each exported report<\/td><td>Who exported student data?<\/td><\/tr><tr><td>API Total Usage<\/td><td>API calls by user and client<\/td><td>Which integration is so busy?<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Event Monitoring vs Setup Audit Trail<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Admins often confuse these two logs. The table below compares them.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Feature<\/th><th>Event Monitoring<\/th><th>Setup Audit Trail<\/th><\/tr><\/thead><tbody><tr><td>Tracks<\/td><td>User activity, like logins and exports<\/td><td>Changes to Setup and configuration<\/td><\/tr><tr><td>Example<\/td><td>Rahul exported a report<\/td><td>Asha changed a profile<\/td><\/tr><tr><td>Cost<\/td><td>Some events free, most need add-on<\/td><td>Included in all orgs<\/td><\/tr><tr><td>Retention<\/td><td>Short for free events, longer with add-on<\/td><td>About six months<\/td><\/tr><tr><td>Best for<\/td><td>Security and usage analysis<\/td><td>Tracking admin changes<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">In short, use Setup Audit Trail to see who changed the org. Use Salesforce Event Monitoring to see what users did with data.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-large\"><a href=\"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/10\/salesforce-event-monitoring-login-history-diagram-2.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"640\" src=\"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/10\/salesforce-event-monitoring-login-history-diagram-2-1024x640.png\" alt=\"Salesforce Event Monitoring diagram comparing Event Monitoring with Setup Audit Trail\" class=\"wp-image-721\" srcset=\"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/10\/salesforce-event-monitoring-login-history-diagram-2-1024x640.png 1024w, https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/10\/salesforce-event-monitoring-login-history-diagram-2-300x188.png 300w, https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/10\/salesforce-event-monitoring-login-history-diagram-2-768x480.png 768w, https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/10\/salesforce-event-monitoring-login-history-diagram-2-1536x960.png 1536w, https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/10\/salesforce-event-monitoring-login-history-diagram-2-2048x1280.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><figcaption class=\"wp-element-caption\">Event Monitoring compared with Setup Audit Trail, and when to use each one.<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Hands-on Example: Salesforce Event Monitoring for a Suspicious Export<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Let&#8217;s investigate a possible data leak in your Developer Edition org.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Check Login History<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to Setup, type &#8220;Login History&#8221; in Quick Find, and open it.<\/li>\n\n<li>Find logins by the user, such as Rahul Verma, on the day in question.<\/li>\n\n<li>Note the time, IP address and browser for each login.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Open the Event Log File Browser<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In Quick Find, type &#8220;Event Log File Browser&#8221; and open it.<\/li>\n\n<li>Filter Event Type to Login and the date to the same day, then download the file.<\/li>\n\n<li>If your org has the add-on, also download the Report Export file.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Query the log files<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Developers can list available log files with this SOQL query.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SELECT Id, EventType, LogDate, LogFileLength\nFROM EventLogFile\nWHERE EventType IN ('Login', 'ReportExport')\nORDER BY LogDate DESC<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The result might look like this.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>EventType     LogDate     LogFileLength\nLogin         2026-07-05  18432\nReportExport  2026-07-05  2210<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Each row points to a CSV file stored in the LogFile field. So you download it through the API or the browser page, because the query itself only returns the file details. For example, a security team might run this query every morning and save new files to a secure drive.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Read the file<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Next, open the CSV in a spreadsheet and filter by user. Columns differ by event type, but the table below shows the ones that matter most.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Column<\/th><th>Meaning<\/th><\/tr><\/thead><tbody><tr><td>TIMESTAMP_DERIVED<\/td><td>When the action happened<\/td><\/tr><tr><td>USER_ID<\/td><td>Who did it<\/td><\/tr><tr><td>CLIENT_IP<\/td><td>Where it came from<\/td><\/tr><tr><td>URI or REPORT_ID<\/td><td>What was opened or exported<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Act and prevent<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If the export was not allowed, freeze the user, as shown in our <a href=\"https:\/\/swapnilzambare.com\/blog\/salesforce-user-management-guide\/\">user management guide<\/a>. Then remove the Export Reports permission from users who do not need it. Also, ask the manager to confirm what the rep exported and why, and record the outcome for the audit.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Common Mistakes with Salesforce Event Monitoring<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Waiting too long.<\/strong> Free event files expire quickly, so download them the same day.<\/li>\n\n<li><strong>Expecting every event for free.<\/strong> Most detailed events need the add-on.<\/li>\n\n<li><strong>Ignoring failed logins.<\/strong> Many failed attempts often come before a break-in.<\/li>\n\n<li><strong>Reading files without filters.<\/strong> Large CSVs are hard to read, so filter by user and time.<\/li>\n\n<li><strong>No follow-up.<\/strong> Logs only help if someone acts on what they show.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Best Practices for Salesforce Event Monitoring<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Review Login History weekly.<\/strong> Look for odd times, places and failures.<\/li>\n\n<li><strong>Store important logs.<\/strong> Save files to a secure place for audits.<\/li>\n\n<li><strong>Limit export permissions.<\/strong> Prevention is better than investigation.<\/li>\n\n<li><strong>Combine logs.<\/strong> Login History, event files and Setup Audit Trail together tell the full story.<\/li>\n\n<li><strong>Plan with security teams.<\/strong> Agree on what to watch and who responds.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Practice Task<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Download the Login event file for yesterday from the Event Log File Browser. Then count the failed logins per user in a spreadsheet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Hint: filter the LOGIN_STATUS column for values other than success.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Salesforce Event Monitoring FAQ<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Is Event Monitoring free?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Some event types are free with short retention. The full set needs the Event Monitoring add-on.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How far back does Login History go?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">It shows recent months of login history. Download it regularly if you need older records.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Can I see who viewed a record?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">With the add-on, page view events can show which records users opened.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Official Resources<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/developer.salesforce.com\/docs\/atlas.en-us.object_reference.meta\/object_reference\/sforce_api_objects_eventlogfile.htm\" target=\"_blank\" rel=\"noopener noreferrer\">EventLogFile (Object Reference)<\/a><\/li>\n\n<li><a href=\"https:\/\/trailhead.salesforce.com\/content\/learn\/modules\/event_monitoring\/event_monitoring_query\" target=\"_blank\" rel=\"noopener noreferrer\">Query Event Log Files (Trailhead)<\/a><\/li>\n\n<li><a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=sf.admin_monitorsetup.htm&amp;type=5\" target=\"_blank\" rel=\"noopener noreferrer\">Monitor Setup Changes with Setup Audit Trail (Salesforce Help)<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Quick Recap<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Salesforce Event Monitoring writes log files about user activity.<\/li>\n\n<li>Login History lists recent login attempts with time and location.<\/li>\n\n<li>A few event types are free, and the add-on adds many more.<\/li>\n\n<li>Query EventLogFile or use the Event Log File Browser to get the files.<\/li>\n\n<li>Setup Audit Trail covers admin changes, not user actions.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What&#8217;s Next?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You can now see what users do with your data. Next, learn how to protect the most sensitive data with encryption. Read <a href=\"https:\/\/swapnilzambare.com\/blog\/salesforce-platform-encryption-guide\/\">Salesforce Platform Encryption and Classic Encryption<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Salesforce Event Monitoring records detailed activity in your org, such as logins, report exports, page views and API calls, in downloadable event log files.&hellip;<\/p>\n","protected":false},"author":1,"featured_media":722,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_swapz_level":"","_swapz_series_part":0,"_swapz_hide_toc":false,"_swapz_hide_featured":false,"_swapz_description":"","footnotes":""},"categories":[67,8,13],"tags":[68,32,7,17],"swapz_series":[],"class_list":["post-794","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-advanced-admin","category-salesforce","category-salesforce-admin","tag-advanced","tag-auditing","tag-salesforce","tag-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Salesforce Event Monitoring and Login History<\/title>\n<meta name=\"description\" content=\"Salesforce Event Monitoring explained: Login History, event log files, free and add-on events, and a hands-on investigation of a suspicious export.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/swapnilzambare.com\/blog\/salesforce-event-monitoring-login-history\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Salesforce Event Monitoring and Login History\" \/>\n<meta property=\"og:description\" content=\"Salesforce Event Monitoring explained: Login History, event log files, free and add-on events, and a hands-on investigation of a suspicious export.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/swapnilzambare.com\/blog\/salesforce-event-monitoring-login-history\/\" \/>\n<meta property=\"og:site_name\" content=\"Swapnil Zambare - Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-16T03:30:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/10\/salesforce-event-monitoring-login-history-featured.png\" \/>\n\t<meta property=\"og:image:width\" content=\"2400\" \/>\n\t<meta property=\"og:image:height\" content=\"1260\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Swapnil Zambare\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Swapnil Zambare\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/salesforce-event-monitoring-login-history\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/salesforce-event-monitoring-login-history\\\/\"},\"author\":{\"name\":\"Swapnil Zambare\",\"@id\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/#\\\/schema\\\/person\\\/922ac0131aaa7088c78c2cb1700e0c9a\"},\"headline\":\"Salesforce Event Monitoring and Login History\",\"datePublished\":\"2026-07-16T03:30:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/salesforce-event-monitoring-login-history\\\/\"},\"wordCount\":1541,\"publisher\":{\"@id\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/salesforce-event-monitoring-login-history\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/salesforce-event-monitoring-login-history-featured.png\",\"keywords\":[\"Advanced\",\"Auditing\",\"Salesforce\",\"Security\"],\"articleSection\":[\"Advanced Admin\",\"Salesforce\",\"Salesforce Admin\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/salesforce-event-monitoring-login-history\\\/\",\"url\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/salesforce-event-monitoring-login-history\\\/\",\"name\":\"Salesforce Event Monitoring and Login History\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/salesforce-event-monitoring-login-history\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/salesforce-event-monitoring-login-history\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/salesforce-event-monitoring-login-history-featured.png\",\"datePublished\":\"2026-07-16T03:30:00+00:00\",\"description\":\"Salesforce Event Monitoring explained: Login History, event log files, free and add-on events, and a hands-on investigation of a suspicious export.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/salesforce-event-monitoring-login-history\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/salesforce-event-monitoring-login-history\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/salesforce-event-monitoring-login-history\\\/#primaryimage\",\"url\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/salesforce-event-monitoring-login-history-featured.png\",\"contentUrl\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/salesforce-event-monitoring-login-history-featured.png\",\"width\":2400,\"height\":1260,\"caption\":\"Salesforce Event Monitoring featured image: see who did what, and when\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/salesforce-event-monitoring-login-history\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Salesforce Event Monitoring and Login History\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/\",\"name\":\"Swapnil Zambare - Blog\",\"description\":\"Salesforce &amp; Tech Guides\",\"publisher\":{\"@id\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/#organization\",\"name\":\"Swapnil Zambare - Blog\",\"url\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/site-icon-512.png\",\"contentUrl\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/site-icon-512.png\",\"width\":512,\"height\":512,\"caption\":\"Swapnil Zambare - Blog\"},\"image\":{\"@id\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/theSwapnilZambare\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/#\\\/schema\\\/person\\\/922ac0131aaa7088c78c2cb1700e0c9a\",\"name\":\"Swapnil Zambare\",\"sameAs\":[\"https:\\\/\\\/swapnilzambare.com\\\/blog\"],\"url\":\"https:\\\/\\\/swapnilzambare.com\\\/blog\\\/author\\\/swapnil-zambare\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Salesforce Event Monitoring and Login History","description":"Salesforce Event Monitoring explained: Login History, event log files, free and add-on events, and a hands-on investigation of a suspicious export.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/swapnilzambare.com\/blog\/salesforce-event-monitoring-login-history\/","og_locale":"en_US","og_type":"article","og_title":"Salesforce Event Monitoring and Login History","og_description":"Salesforce Event Monitoring explained: Login History, event log files, free and add-on events, and a hands-on investigation of a suspicious export.","og_url":"https:\/\/swapnilzambare.com\/blog\/salesforce-event-monitoring-login-history\/","og_site_name":"Swapnil Zambare - Blog","article_published_time":"2026-07-16T03:30:00+00:00","og_image":[{"width":2400,"height":1260,"url":"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/10\/salesforce-event-monitoring-login-history-featured.png","type":"image\/png"}],"author":"Swapnil Zambare","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Swapnil Zambare","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/swapnilzambare.com\/blog\/salesforce-event-monitoring-login-history\/#article","isPartOf":{"@id":"https:\/\/swapnilzambare.com\/blog\/salesforce-event-monitoring-login-history\/"},"author":{"name":"Swapnil Zambare","@id":"https:\/\/swapnilzambare.com\/blog\/#\/schema\/person\/922ac0131aaa7088c78c2cb1700e0c9a"},"headline":"Salesforce Event Monitoring and Login History","datePublished":"2026-07-16T03:30:00+00:00","mainEntityOfPage":{"@id":"https:\/\/swapnilzambare.com\/blog\/salesforce-event-monitoring-login-history\/"},"wordCount":1541,"publisher":{"@id":"https:\/\/swapnilzambare.com\/blog\/#organization"},"image":{"@id":"https:\/\/swapnilzambare.com\/blog\/salesforce-event-monitoring-login-history\/#primaryimage"},"thumbnailUrl":"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/10\/salesforce-event-monitoring-login-history-featured.png","keywords":["Advanced","Auditing","Salesforce","Security"],"articleSection":["Advanced Admin","Salesforce","Salesforce Admin"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/swapnilzambare.com\/blog\/salesforce-event-monitoring-login-history\/","url":"https:\/\/swapnilzambare.com\/blog\/salesforce-event-monitoring-login-history\/","name":"Salesforce Event Monitoring and Login History","isPartOf":{"@id":"https:\/\/swapnilzambare.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/swapnilzambare.com\/blog\/salesforce-event-monitoring-login-history\/#primaryimage"},"image":{"@id":"https:\/\/swapnilzambare.com\/blog\/salesforce-event-monitoring-login-history\/#primaryimage"},"thumbnailUrl":"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/10\/salesforce-event-monitoring-login-history-featured.png","datePublished":"2026-07-16T03:30:00+00:00","description":"Salesforce Event Monitoring explained: Login History, event log files, free and add-on events, and a hands-on investigation of a suspicious export.","breadcrumb":{"@id":"https:\/\/swapnilzambare.com\/blog\/salesforce-event-monitoring-login-history\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/swapnilzambare.com\/blog\/salesforce-event-monitoring-login-history\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/swapnilzambare.com\/blog\/salesforce-event-monitoring-login-history\/#primaryimage","url":"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/10\/salesforce-event-monitoring-login-history-featured.png","contentUrl":"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/10\/salesforce-event-monitoring-login-history-featured.png","width":2400,"height":1260,"caption":"Salesforce Event Monitoring featured image: see who did what, and when"},{"@type":"BreadcrumbList","@id":"https:\/\/swapnilzambare.com\/blog\/salesforce-event-monitoring-login-history\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/swapnilzambare.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Salesforce Event Monitoring and Login History"}]},{"@type":"WebSite","@id":"https:\/\/swapnilzambare.com\/blog\/#website","url":"https:\/\/swapnilzambare.com\/blog\/","name":"Swapnil Zambare - Blog","description":"Salesforce &amp; Tech Guides","publisher":{"@id":"https:\/\/swapnilzambare.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/swapnilzambare.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/swapnilzambare.com\/blog\/#organization","name":"Swapnil Zambare - Blog","url":"https:\/\/swapnilzambare.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/swapnilzambare.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/09\/site-icon-512.png","contentUrl":"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/09\/site-icon-512.png","width":512,"height":512,"caption":"Swapnil Zambare - Blog"},"image":{"@id":"https:\/\/swapnilzambare.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/in\/theSwapnilZambare"]},{"@type":"Person","@id":"https:\/\/swapnilzambare.com\/blog\/#\/schema\/person\/922ac0131aaa7088c78c2cb1700e0c9a","name":"Swapnil Zambare","sameAs":["https:\/\/swapnilzambare.com\/blog"],"url":"https:\/\/swapnilzambare.com\/blog\/author\/swapnil-zambare\/"}]}},"_links":{"self":[{"href":"https:\/\/swapnilzambare.com\/blog\/wp-json\/wp\/v2\/posts\/794","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/swapnilzambare.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/swapnilzambare.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/swapnilzambare.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/swapnilzambare.com\/blog\/wp-json\/wp\/v2\/comments?post=794"}],"version-history":[{"count":0,"href":"https:\/\/swapnilzambare.com\/blog\/wp-json\/wp\/v2\/posts\/794\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/swapnilzambare.com\/blog\/wp-json\/wp\/v2\/media\/722"}],"wp:attachment":[{"href":"https:\/\/swapnilzambare.com\/blog\/wp-json\/wp\/v2\/media?parent=794"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/swapnilzambare.com\/blog\/wp-json\/wp\/v2\/categories?post=794"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/swapnilzambare.com\/blog\/wp-json\/wp\/v2\/tags?post=794"},{"taxonomy":"swapz_series","embeddable":true,"href":"https:\/\/swapnilzambare.com\/blog\/wp-json\/wp\/v2\/swapz_series?post=794"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}