The next and the last auditing technique that we are going to talk about.
He is logging four and six this auditing technique is all about capturing data regarding an args log
in evens.
So when we say capturing data about the logging evens.
Yes.
What you are assuming is the right logging forensics is a concept that is very much related to log in
history.
And I think you should have made more sense if I had to put these together the logging history and logging
Forensics said rather than having these apart.
But anyways that's fine.
So logging forensics and logging history are in a way related in the in the basis that both the techniques
both logging history and logging forensics they capture the args logging events.
So when do you say that both techniques have the same or similar underlying concepts.
How do they differ.
Right.
We need to understand how do the concepts differ from each other.
This is a quick differentiation between the logging history concept that we discussed earlier and the
logging forensics concept in fact that these two concepts are in a way similar to the setting up up
field history tracking and field audit trap field audit trail venal it is a much bigger wash an off
field history tracking right field history tracking has got many limitations with the number of fields
that can be tracked and the duration in which the data is being retained right down the field audit
trail.
It came as a much bigger wash and with a lot of flexibility when compared to field history tracking
but yeah.
Field audit trail that comes at a price.
Right.
Similarly you log in history and log forensics logging and forensics is a much bigger wash an off logging
history you log in history the data is retained for only up to six months but in logging forensics the
data is retained for up to 10 years and it can be created that data from the EPA.
Yes.
What does the object for log in history the object as logging history object and for logging forensics
it is logging event object and logging history then we did.
That's another devil operation we were able to completely see how the data is being logged the users
log in it is being locked and we were able to completely do that in the you white and we also have EPA
access right to begin query this specific table to pull in the information but for logging forensics
the data is only available through API will not be able to save that it definitely white from the user
interface and the logging history does include it in all args but logging forensics it comes with a
price it is included only with some paid add on subscriptions the salesforce she'd order with even monitoring
add on subscriptions so these are some of the major differences between log in history and log in 4
and 6 and you can see that log and do with underlying concept of the same logging forensics is a much
better and bigger wash off log in history and there's a logging forensics we generally use to identify
any unusual behavior within the organization so we can a wider identity fraud and for other security
concerns and that this logging forensics we get information about that the average number of logging
spore user for a specified time period and who logged in more than the average number of times who logged
in doing non-business hours who logged in during the day as a species IP ranges all these informations
can be tracked using log in forensics now let's jump into our samples a devil operation ARD and let's
see how do we configured this log in four and six go to set up look for event monitoring settings
and here you can see log in forensics so if you would like to enable log in forensics then enable this
functionality and it gets enabled and once you enable log and forensics functionality you will be able
to track all the logging events and you will be able to pull all those data from your metadata API and
you know the data is retained for up to 10 years.
And as we discussed earlier will not be able to see the data in the UI.
We have to only use the API to quitting our data.
So for that either you can go for workbench or you can use a developer console to basically query and
pull in the data.
Let me quickly use a developer console and show you how to execute those as secured creditors.
So go to developer console.
This is the equity for the log in even the standard object.
And as we discussed earlier log in forensics the data is captured in logging event and for logging history
the data is captured in a table called log in history.
So for logging forensics laughter we enable that functionality we'll be able to query this object logging
event you can use developer console or workbench and you can see these are all the various fields that
are available in that particular table the API was an application even to identify a date created a
log in status.
Everything all the information that's captured in this particular table and the v just to enable this
functionality and after that I just log than once.
So there is only one entry out here.
But after a late run as and when users log in there.
This table will be capturing all those information.
So this is a log in four and six.
But let me also show you how to use the logging history table which captures all the logging history
information.
Let me delete this Kristie.
Let me query the logging history table.
Basically it also has a similar field and let me execute that and you can see there are many entries
for that right.
Because this a by default saves all the logging events that is happening in the ah.
That's all right.
The time when I created this ARG and the number of times I have logged in other uses of logging the
method of logging everything that's captured in this particular table.
But the data here is written only for up to six months that for logging forensics the data is retained
for up to 10 years and for logging history we see that we are able to pull this information in the API
and we can also pull the similar information in from the way as well.
All right.
We can do that very much for logging history but for logging event that is for logging forensics is
the only place where we can retrieve the data.
I will not be able to use user interface for pulling the information so you can use developer console
or workbench or if other API tools for extracting that information.
So this is all about logging forensics and how it differs from logging history.