Code42 predicts filenames for Salesforce report downloads
Overview
When Code42 detects that a report has been exported from Salesforce, it predicts a filename for that downloaded report based on Salesforce defaults. This article describes how that predicted filename is structured and where you can view it in Incydr.
Salesforce file event details
For any Salesforce event (listed on dashboards, in watchlists or user profiles, in Alerts, or in Forensic Search results), click View details 
to view the file event metadata collected about that activity. The filename that Code42 predicts for the report appears under the File section in the event details.
The filename that Code42 predicts for the report varies based on the file format the user chose during export.
- XLSX format: The predicted filename contains the report name followed by the date and time the report was exported.
- For saved reports, the report name is the name selected when the report was saved.
- For ad hoc reports, the report name is simply "Report."
- XLS or CSV formats (not available for Formatted Reports in Salesforce): The predicted filename contains "report" followed by a 13-number string. In this string, the first 10 numbers are the epoch (UNIX) timestamp, while the last three digits represent milliseconds.
Predicted filenames may not match actual downloaded filenames
The filename that Code42 predicts for an exported report may not exactly match the actual filename downloaded to the endpoint. This filename can differ when the user:
The filename that Code42 predicts for an exported report may not exactly match the actual filename downloaded to the endpoint. This filename can differ when the user:
- Chooses a different name when prompted by the web browser to name the downloaded file.
- Selects either the XLS or CSV format when exporting a Details Only report. Code42 cannot capture the last 3-digit millisecond value in the default Salesforce filename and appends three 0s (zeroes) instead. In this case, if the actual downloaded filename on the user's device is report1642777476321, Code42 displays report1642777476000 as its filename in Forensic Search instead.