1. Define transaction security policies using declarative condition builder or Apex.
2. Design use case specific custom security policies to respond to insider threats and stop your data from leaving your organization’s boundaries.
3. Setup notifications to proactively respond to alerts with custom code.

Difference between Condition Builder and Apex-Based Policies

Condition Builder is a feature in Setup that lets you create policies using clicking, without needing to write any code. With Condition Builder, you can select specific fields from certain objects to keep an eye on customer activities. The actions of your policy depend on how users interact with these fields, which is why they are known as conditions.

This example implements a policy that triggers when someone adds a field to a List View with a name containing ‘Email‘.

However, the choices of conditions in Condition Builder are limited. They are just a part of all the possible fields in event objects and depend on the type of object you’re dealing with. On the other hand, if you make a policy using Apex code, you can use any field from the event objects.

For example, if you want to define a transaction security policy using Data Classification, the only option is to use Apex code.

Define the Transaction Security Policy using Apex

It is now time to solve business use cases #2 and #3. We have already defined the Data Classification for the Contact’s Email as mentioned above (Define the Data Classification Values).  

Before proceeding, you should familiarize yourself with the following objects in Salesforce.

Follow the steps below to create an Apex class and a Transaction Security policy to address the given business use case.

Step 1: Create an Apex Class that Implement the TxnSecurity.EventCondition Interface

1. Create an Apex Class, ReportSecurityEvaluator, use to evaluate the security of data in reports. It implements the TxnSecurity.EventCondition interface, which is part of Salesforce’s transaction security framework. The class contains methods to assess if a report accesses sensitive data based on predefined data classification levels.
   Copy Code Copied Use a different Browser

   
   global class ReportSecurityEvaluator implements TxnSecurity.EventCondition {
       
       public boolean evaluate(SObject event) {
           switch on event {
               when ReportEvent reportEvent {
                   if (reportEvent.QueriedEntities.contains('Contact')) {
                       return hasRestrictedColumn(reportEvent.ColumnHeaders);
                   }
                   return false;
               }
               when null {
                   return false;   
               }
               when else {
                   return false;
               }
           }
       }
       
       private boolean hasRestrictedColumn(String ColumnHeaders) {
           
           Map<String, String> fieldToSecurityLevel = getFieldSecurityMap();
           List<String> columnNames = parseColumnHeaders(ColumnHeaders);
           
           for (String columnName : columnNames) {
               String securityLevel = fieldToSecurityLevel.get(columnName);
               if ('Restricted'.equalsIgnoreCase(securityLevel)) {
                   return true;
               }
           }
           return false; 
       }
       
       private Map<String, String> getFieldSecurityMap() {
           Map<String, String> securityMap = new Map<String, String>();
           
           List<FieldDefinition> fieldDefinitions = [
               SELECT SecurityClassification, QualifiedApiName
               FROM FieldDefinition
               WHERE EntityDefinition.QualifiedApiName = 'Contact'];
           
           for (FieldDefinition fieldDefinition : fieldDefinitions) {
               if (fieldDefinition.SecurityClassification != null) {
                   securityMap.put(fieldDefinition.QualifiedApiName, fieldDefinition.SecurityClassification);
               }
           }
           return securityMap;
       }
       
       private List<String> parseColumnHeaders(String columnHeadersCSV) {
           List<String> sanitizedColumnNames = new List<String>();
           
           try {
               Integer closingBracketIndex = columnHeadersCSV.indexOf(']');
               if (closingBracketIndex != -1) {
                   columnHeadersCSV = columnHeadersCSV.substring(0, closingBracketIndex + 1);
               }
               
               String cleanHeaders = columnHeadersCSV.trim().replaceAll('\\[|\\]', '');
               List<String> columnHeaders = cleanHeaders.split(',\\s?');
               
               for (String header : columnHeaders) {
                   Integer lastDotIndex = header.lastIndexOf('.');
                   String columnName = lastDotIndex != -1 ? header.substring(lastDotIndex + 1) : header;
                   sanitizedColumnNames.add(columnName.toLowerCase().capitalize());
               }
           } catch (Exception e) {
               return new List<String>();
           }
           return sanitizedColumnNames;
       }
   }
   

Step 2: Create an Enhanced Transaction Security Policy That Uses Apex

1. Click Setup.
2. In the Quick Find box, type Transaction Security.
3. Select Transaction Security Policies, then click on the New.
4. Select Apex, then Click Next.
5. Select the following data
   1. Event: ReportEvent
   2. Apex Class: ReportSecurityEvaluator
6. Click Next.
7. Select the action that the policy performs when triggered.
   1. Action: Block
   2. Block Message: Default Block message
   3. Notification:
      1. Email notification
      2. In-App notification
   4. Recipient: Rakesh Gupta
   5. Email Notification Content: Default Email Content
   6. Name: Someone tried to download a report with restricted fields.
   7. Status: Enabled    
      1. 
8. Click Finish.