Notifications
Clear all
Topic starter
02/08/2026 12:23 pm
TL;DR: Retention, edition limits, and delayed log delivery can still obscure persistence and investigation timelines, especially in SaaS supply-chain intrusions and phantom identity provider abuse, according to Abstract Security’s analysis of Salesforce’s multiple telemetry layers. The real problem is not visibility in the abstract, but whether identity and audit signals survive long enough to support correlation and response.
NHIMG editorial — based on content published by Abstract Security: Security Salesforce Forensics: Telemetry for Detection & Response
By the numbers:
- Event Monitoring log files are retained for 1 day in Developer Edition and 30 days in Enterprise Edition.
- Setup Audit Trail records are retained for up to 180 days within the platform.
Questions worth separating out
Q: What breaks when Salesforce logs are not retained long enough for investigation?
A: Investigators lose the ability to reconstruct authentication, configuration, and data-access sequences as one coherent timeline.
Q: Why do SaaS applications complicate identity investigations compared with core IAM logs?
A: Because the decisive evidence is split across platform-specific telemetry, application configuration, and connected identity providers.
Q: How can security teams detect phantom identity provider abuse?
A: Look for unexpected identity provider additions, authentication flows that do not match the primary enterprise trust path, and configuration changes that coincide with unusual login or object activity.
Practitioner guidance
- Correlate identity and audit streams before an incident Join Login History, Setup Audit Trail, Event Monitoring, and object history into one investigative timeline so authentication, configuration, and data access can be reviewed together.
- Treat identity provider changes as high-risk governance events Review every new or modified identity provider, delegated authentication setting, and session policy change as an access-plane change that requires ownership and rollback planning.
- Export SaaS telemetry to an external evidence store Preserve raw logs outside Salesforce so delayed delivery, short retention, or edition limits do not erase the first hours of an investigation.
What's in the full article
Abstract Security's full article covers the operational detail this post intentionally leaves for the source:
- Edition-by-edition telemetry availability for Salesforce, including which log sources exist in Essentials, Starter, Professional, Enterprise, Unlimited, and Developer tiers
- Field-level and object-level forensic reconstruction examples that show how investigators join records across Salesforce tables
- Timing and retention nuances for Login History, Setup Audit Trail, and Event Monitoring when building a real incident timeline
- Threat Detection and session-hijacking telemetry details that are useful when you need platform-specific detection logic
👉 Read Abstract Security's analysis of Salesforce forensics and telemetry for detection →
Salesforce telemetry and SaaS persistence: what IAM teams need now?
Explore further
02/08/2026 1:23 pm
Phantom identity provider persistence is a trust-plane problem, not just a log problem. The article shows that a rogue provider can continue authenticating inside Salesforce while centralized identity teams believe the environment is governed. That breaks the assumption that the authoritative IdP is always the only trust source. For practitioners, the governance question is who can create, approve, and revoke alternate trust planes before they become hidden persistence paths.
A few things that frame the scale:
- Event Monitoring log files are retained for 1 day in Developer Edition and 30 days in Enterprise Edition, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: Who should own Salesforce forensic readiness in an identity programme?
A: IAM, IGA, and PAM should share ownership with security operations because the relevant evidence spans authentication, privilege change, and administrative configuration. If ownership sits only with the application team, the environment may remain usable but not investigable when a compromise occurs.
👉 Read our full editorial: Salesforce telemetry gaps leave SaaS persistence harder to spot
