Use the new Real-Time Event Monitoring Permission Set Event (generally available) to monitor permission changes and even make Transaction Security policies for user permissions. The APITotalUsage event log file type helps you track unused API versions. And the new USER_TYPE field helps identify if users associated with events are authenticated or guest users. Shield Platform Encryption now supports the User Email field (beta) and contact point fields.
- Shield Platform Encryption
By popular demand, Shield Platform Encryption for User Email (beta) offers an extra layer of protection for user emails used throughout your Salesforce deployment. You can also encrypt addresses, email addresses, and phone numbers for the points of contact associated with individual and person accounts. - Event Monitoring
Some Event Log File types now include aUSER_TYPEfield to help you identify whether users associated with events are authenticated or guest users. The new API Total Usage event type gives admins insights into which orgs use retired API versions. And, use the Security Center app to review metrics about Threat Detection events (beta).
https://help.salesforce.com/s/articleView?id=release-notes.rn_security_shield.htm&release=232&type=5