Detecting Suspicious Access to CRM Data in SaaS Environments

ID: DET0550
Domains: Enterprise
Analytics: AN1520
Version: 1.0
Created: 21 October 2025
Last Modified: 21 October 2025

Analytics

AN1520

Anomalous high-volume access to customer records in CRM software by a non-CRM admin user account, especially following initial authentication from a rare location or device. Behavior includes abnormal access to PII fields or data exports within a short time window.

Log Sources
Data Component Name Channel
Application Log Content (DC0038) saas:salesforce DataExport, RestAPI, Login, ReportExport
Logon Session Creation (DC0067) m365:signinlogs UserLoggedIn
Mutable Elements
Field Description
TimeWindow Duration over which bulk CRM queries occur (e.g., 1 minute, 5 minutes); varies by organization usage pattern
UserContext User's CRM role, department, or job function (e.g., non-sales user accessing customer PII)
AnomalousExportThreshold Number of CRM objects (contacts, deals, logs) accessed or exported above normal
SourceLocation Rare or impossible geolocation/IP address for legitimate CRM user access