{ "name": "SalesforceEventLogConnector", "apiVersion": "2025-09-01", "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", "location": "{{location}}", "kind": "Customizable", "properties": { "connectorUiConfig": { "id": "SalesforceEventLogConnector", "title": "Salesforce Service Cloud (via Codeless Connector Framework)", "publisher": "Microsoft", "descriptionMarkdown": "The Salesforce Service Cloud data connector provides the capability to ingest information about your Salesforce operational events into Microsoft Sentinel through the REST API. The connector provides ability to review events in your org on an accelerated basis, get [event log files](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/event_log_file_hourly_overview.htm) in hourly increments for recent activity.", "graphQueriesTableName": "SalesforceServiceCloudV3_CL", "graphQueries": [ { "metricName": "Total data received", "legend": "Salesforce Service Cloud EventLogFile Events", "baseQuery": "SalesforceServiceCloudV3_CL" } ], "sampleQueries": [ { "description": "Get a sample of Salesforce Service Cloud Event Log File Events", "query": "SalesforceServiceCloudV3_CL\n| take 10" } ], "dataTypes": [ { "name": "SalesforceServiceCloudV3_CL", "lastDataReceivedQuery": "SalesforceServiceCloudV3_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], "connectivityCriteria": [ { "type": "HasDataConnectors" } ], "availability": { "isPreview": false, "status": 1 }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "Read and Write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "read": true, "delete": true, "action": false } } ], "customs": [ { "name": "Salesforce Service Cloud API access", "description": "Access to the Salesforce Service Cloud API through a Connected App is required." } ] }, "instructionSteps": [ { "title": "Connect to Salesforce Service Cloud API to start collecting event logs in Microsoft Sentinel", "description": "Follow [Create a Connected App in Salesforce for OAuth](https://help.salesforce.com/s/articleView?id=platform.ev_relay_create_connected_app.htm&type=5) and [Configure a Connected App for the OAuth 2.0 Client Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_client_credentials_setup.htm&type=5) to create a Connected App with access to the Salesforce Service Cloud API. Through those instructions, you should get the Consumer Key and Consumer Secret.\n For Salesforce Domain name, Go to Setup, type My Domain in the Quick Find box, and select My Domain to view your domain details. Make sure to enter the domain name without a trailing slash (e.g., https://your-domain.my.salesforce.com). Fill the form below with that information.", "instructions": [ { "type": "MessageBar", "parameters": { "text": "**Notice:** Solution version 3.2.0 and later uses the SalesforceServiceCloudV3_CL table. Please use updated parser for any existing queries. Refer to the release notes of the solution [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce%20Service%20Cloud/ReleaseNotes.md)", "type": "warning" } } ] }, { "title": "Manage Salesforce Connections", "description": "Add, view, and delete Salesforce connections", "instructions": [ { "type": "DataConnectorsGrid", "parameters": { "mapping": [ { "columnName": "Connector Alias", "columnValue": "properties.addOnAttributes.friendlyName" }, { "columnName": "Salesforce Base URL", "columnValue": "properties.addOnAttributes.apiUrl" }, { "columnName": "Data Type", "columnValue": "properties.addOnAttributes.dataType" }, { "columnName": "Grant Type", "columnValue": "properties.addOnAttributes.grantType" } ], "menuItems": [ "DeleteConnector" ] } }, { "type": "ContextPane", "parameters": { "isPrimary": true, "label": "Add Connection", "title": "Configure API Connection", "subtitle": "Connect to Salesforce to ingest data", "contextPaneType": "DataConnectorsContextPane", "instructionSteps": [ { "title": "Base Configuration", "description": "Configure your Salesforce API connection", "instructions": [ { "type": "Textbox", "parameters": { "label": "Connection Alias", "placeholder": "Production or Sandbox", "type": "text", "name": "friendlyName", "validations": { "required": true } } }, { "type": "InfoMessage", "parameters": { "text": "Enter a unique alias to identify this Salesforce connection. **Important**: Use different aliases for each domain. To update an existing connection, use the same alias or delete and create with the same alias. To replace a connection, delete the old one and create a new one with a new alias.", "visible": true, "inline": true } }, { "type": "Dropdown", "parameters": { "label": "Query interval (in minutes)", "name": "queryWindow", "options": [ { "key": "5", "text": "5" }, { "key": "10", "text": "10" }, { "key": "15", "text": "15" }, { "key": "20", "text": "20" }, { "key": "30", "text": "30" }, { "key": "60", "text": "60" } ], "placeholder": "Select interval (e.g., 10)", "required": true } }, { "type": "Textbox", "parameters": { "label": "Salesforce Base URL", "placeholder": "Example: https://your-domain.my.salesforce.com", "type": "url", "name": "salesforceBaseUrl", "validations": { "required": true } } }, { "type": "InfoMessage", "parameters": { "text": "Enter the base URL of your Salesforce instance without trailing slash (e.g., https://your-domain.my.salesforce.com)", "visible": true, "inline": true } }, { "type": "Dropdown", "parameters": { "label": "Log Collection Interval", "name": "queryType", "options": [ { "key": "SELECT Id,EventType,LogDate,Interval,CreatedDate,LogFile,LogFileLength FROM EventLogFile WHERE Interval='Hourly' and CreatedDate>{_QueryWindowStartTime} and CreatedDate<{_QueryWindowEndTime}", "text": "Hourly" }, { "key": "SELECT Id,EventType,LogDate,CreatedDate,LogFile,LogFileLength FROM EventLogFile WHERE CreatedDate>{_QueryWindowStartTime} and CreatedDate<{_QueryWindowEndTime}", "text": "Daily" } ], "placeholder": "Select an interval type", "isMultiSelect": false, "required": true } }, { "type": "Dropdown", "parameters": { "label": "Data Types", "name": "selectedDataTypes", "options": [ { "key": "eventLogFile", "text": "Event Log File - Salesforce operational events" } ], "placeholder": "Select data types to collect...", "isMultiSelect": true, "defaultAllSelected": true, "required": true } } ] }, { "title": "OAuth2 Credentials", "description": "Configure OAuth2 credentials for API access", "instructions": [ { "type": "Markdown", "parameters": { "content": "### OAuth2 Client Credentials" } }, { "type": "InfoMessage", "parameters": { "text": "The Salesforce connector supports two types of OAuth2 client credentials flow to authenticate with all API endpoints - Client Credentials and Username-Password. These credentials provide access to the selected data stream.", "visible": true, "inline": true } }, { "type": "InfoMessage", "parameters": { "text": "**Important:** For legacy or classic setup, ensure that the security token is appended to your password for the password-based grant type authentication to work. For lightning, passing just the password should work. For more information, refer to the [OAuth 2.0 Username-Password Flow for Special Scenarios](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_username_password_flow.htm&type=5).", "visible": true, "inline": true } }, { "type": "Radio", "parameters": { "title": "Grant Type", "name": "salesforceGrantType", "validations": { "required": true }, "options": [ { "label": "Client Credentials", "value": "client_credentials", "instructions": [ { "type": "Textbox", "parameters": { "label": "Consumer Key", "placeholder": "Enter Connected App Consumer Key", "type": "text", "name": "clientId", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "Consumer Secret", "placeholder": "Enter Connected App Consumer Secret", "type": "password", "name": "clientSecret", "validations": { "required": true } } } ] }, { "label": "Password", "value": "password", "instructions": [ { "type": "Textbox", "parameters": { "label": "Consumer Key", "placeholder": "Enter Connected App Consumer Key", "type": "text", "name": "clientId", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "Consumer Secret", "placeholder": "Enter Connected App Consumer Secret", "type": "password", "name": "clientSecret", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "Username", "placeholder": "Enter your Salesforce username", "type": "text", "name": "username", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "Password", "placeholder": "Enter your Salesforce password", "type": "password", "name": "password", "validations": { "required": true } } } ] } ] } } ] } ] } } ] } ] } } }