Overview
When Incydr detects that a report has been exported from Salesforce, it predicts a filename for that downloaded report based on Salesforce defaults. This article describes how that predicted filename is structured and where you can view it in Incydr.
Salesforce file event details
For any Salesforce event (listed on dashboards, in watchlists or user profiles, in Alerts, or in Forensic Search results), click View details to view the file event metadata collected about that activity. The filename that Incydr predicts for the report appears under the File section in the event details.
The filename that Incydr predicts for the report varies based on the file format the user chose during export.
-
XLSX format: The predicted filename contains the report name followed by the date and time the report was exported.
- For saved reports, the report name is the name selected when the report was saved.
- For ad hoc reports, the report name is simply "Report."
- XLS or CSV formats (not available for Formatted Reports in Salesforce): The predicted filename contains "report" followed by a 13-number string. In this string, the first 10 numbers are the epoch (UNIX) timestamp, while the last three digits represent milliseconds.
Predicted filenames may not match actual downloaded filenames
The filename that Incydr predicts for an exported report may not exactly match the actual filename downloaded to the endpoint. This filename can differ when the user:
The filename that Incydr predicts for an exported report may not exactly match the actual filename downloaded to the endpoint. This filename can differ when the user:
- Chooses a different name when prompted by the web browser to name the downloaded file.
- Selects either the XLS or CSV format when exporting a Details Only report. Incydr cannot capture the last 3-digit millisecond value in the default Salesforce filename and appends three 0s (zeroes) instead. In this case, if the actual downloaded filename on the user's device is report1642777476321, Incydr displays report1642777476000 as its filename in Forensic Search instead.
Comments
Please sign in to leave a comment.