SalesForce Real-Time Event Monitoring Connector (via Codeless Connector Framework)

Connect to Salesforce Event Monitoring to start collecting real-time event monitoring logs in Microsoft Sentinel

Follow [Create a Connected App in Salesforce for OAuth](https://help.salesforce.com/s/articleView?id=platform.ev_relay_create_connected_app.htm&type=5) and [Configure a Connected App for the OAuth 2.0 Client Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_client_credentials_setup.htm&type=5) to create a Connected App with access to the Salesforce Event Monitoring API. Through those instructions, you should get the Consumer Key and Consumer Secret. For Salesforce Domain name, Go to Setup, type My Domain in the Quick Find box, and select My Domain to view your domain details. Make sure to enter the domain name without a trailing slash (e.g., https://your-domain.my.salesforce.com). Fill the form below with that information.

**Required Add-on subscription:** Your Salesforce account should include Salesforce Shield or Salesforce Event Monitoring add-on subscriptions for this connector to work.

Manage Salesforce Connections

Add, view, and delete Salesforce connections

Add Connection

Configure API Connection

Base Configuration

Configure your Salesforce API connection

Connection Alias

Enter a unique alias to identify this Salesforce connection. **Important**: Use different aliases for each domain. To update an existing connection, use the same alias or delete and create with the same alias. To replace a connection, delete the old one and create a new one with a new alias.

Query interval (in minutes)

5

10

15

20

30

60

Salesforce Base URL

Enter the base URL of your Salesforce instance without trailing slash (e.g., https://your-domain.my.salesforce.com)

Data Types

ApiAnomalyEventStore

ApiEvent

BulkApiResultEventStore

CredentialStuffingEventStore

FileEventStore

GuestUserAnomalyEventStore

IdentityVerificationEvent

IdentityProviderEventStore

LightningUriEvent

ListViewEvent

LoginAnomalyEventStore

LoginAsEvent

LoginEvent

LogoutEvent

PermissionSetEventStore

ReportAnomalyEventStore

ReportEvent

SessionHijackingEventStore

UniversalAnomalyEventStore

UriEvent

OAuth2 Credentials

Configure OAuth2 credentials for API access

The Salesforce connector supports two types of OAuth2 client credentials flow to authenticate with all API endpoints - Client Credentials and Username-Password. These credentials provide access to the selected data stream.

**Important:** For legacy or classic setup, ensure that the security token is appended to your password for the password-based grant type authentication to work. For lightning, passing just the password should work. For more information, refer to the [OAuth 2.0 Username-Password Flow for Special Scenarios](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_username_password_flow.htm&type=5).

Grant Type

Client Credentials

Consumer Key

Consumer Secret

Password

Consumer Key

Consumer Secret

Username

Password