BanibrataChatterjee Salesforce Shield Deployment
Shield bundles Platform Encryption, Event Monitoring (RTEM + log files), and Field Audit Trail. Deployment order matters: encrypt fields first (with key) → turn on audit trail → onboard log consumers. This skill lays out the sequence, the gotchas for SOQL filters, and retention policy targets.
When to Use
Initial Shield enablement, or expanding coverage to a new object. Not for day-2 tweaks (see encryption-key-rotation).
Typical trigger phrases that should route to this skill: shield rollout plan, enable event monitoring, field audit trail retention, shield encryption field by field.
Recommended Workflow
- Confirm Shield license + Tenant Secret strategy (platform or BYOK).
- Encrypt fields one object at a time; pause for SOQL regression (filter on encrypted fields requires deterministic mode).
- Turn on Field Audit Trail policies — set retention per regulatory requirement (up to 10 years).
- Subscribe log consumer (Splunk / Sumo / S3 via Event Monitoring Analytics App) to RealTimeEventMonitoring streams.
- Rehearse an incident: pull LoginEventStream for a user, correlate with SetupAuditTrail, prove end-to-end visibility.
Key Considerations
- Deterministic vs. probabilistic encryption affects SOQL queryability.
- Event Monitoring EventLogFile is hourly/daily; RealTime is streaming — wire both for completeness.
- Field Audit Trail consumes storage; plan archive pipeline to S3 for long-term retention.
- Event Monitoring + Shield require different licenses; confirm before planning.
Worked Examples (see references/examples.md)
- PCI program Shield rollout — Retailer with PAN tokenized externally but transaction amounts must be encrypted at rest.
- Zero-trust log monitoring — Fraud detection team needs suspicious login alerts.
Common Gotchas (see references/gotchas.md)
- SOQL LIKE on probabilistic encrypted field — Returns zero rows silently.
- Unbounded FHR storage — Storage bill balloons.
- Real-time events dropped — Consumer lagging.
Top LLM Anti-Patterns (full list in references/llm-anti-patterns.md)
- Turning on Shield without a SOQL regression pass
- Never rehearsing an incident log pull
- Buying Shield but never onboarding to SIEM
Official Sources Used
- Apex Developer Guide — Sharing — https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_bulk_sharing_understanding.htm
- Salesforce Security Guide — https://help.salesforce.com/s/articleView?id=sf.security.htm
- Shield Platform Encryption — https://help.salesforce.com/s/articleView?id=sf.security_pe_overview.htm
- Session Security Levels — https://help.salesforce.com/s/articleView?id=sf.security_hap_session.htm
- CSP and Trusted URLs — https://help.salesforce.com/s/articleView?id=sf.security_csp_overview.htm
- API Only User Profile — https://help.salesforce.com/s/articleView?id=sf.users_profiles_api_only.htm
- Privacy Center and DSR — https://help.salesforce.com/s/articleView?id=sf.privacy_center_overview.htm