{ "name": "SalesForceRTEMConnector", "apiVersion": "2024-09-01", "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", "location": "{{location}}", "kind": "Customizable", "properties": { "connectorUiConfig": { "id": "SalesForceRTEMConnector", "title": "SalesForce Real-Time Event Monitoring Connector (via Codeless Connector Framework)", "publisher": "Microsoft", "descriptionMarkdown": "The Salesforce Real-Time Event Monitoring (RTEM) Connector provides the capability to ingest information about your Salesforce real time events using Object for Event Storage into Microsoft Sentinel through the REST API. The connector provides ability to review events in your org on an accelerated basis, get [real-time event data](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/platform_events_objects_monitoring.htm) for recent activity.", "graphQueriesTableName": "SalesForceRealTimeEventMonitoring_CL", "graphQueries": [ { "metricName": "Total Real-Time Event Monitoring logs received", "legend": "Salesforce RTEM Logs", "baseQuery": "SalesForceRealTimeEventMonitoring_CL" } ], "sampleQueries": [ { "description": "Get sample of Salesforce RTEM logs", "query": "SalesForceRealTimeEventMonitoring_CL\n | take 10" }, { "description": "Get Salesforce Login Events", "query": "SalesForceRealTimeEventMonitoring_CL\n | where EventType == \"LoginEvent\"\n | take 10" } ], "dataTypes": [ { "name": "SalesForceRealTimeEventMonitoring_CL", "lastDataReceivedQuery": "SalesForceRealTimeEventMonitoring_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" } ], "connectivityCriteria": [ { "type": "HasDataConnectors" } ], "availability": { "isPreview": false, "status": 1 }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "Read and Write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "read": true, "delete": true, "action": false } } ], "customs": [ { "name": "Salesforce Event Monitoring API access", "description": "Access to the Salesforce Event Monitoring API through a Connected App is required." } ] }, "instructionSteps": [ { "title": "Connect to Salesforce Event Monitoring to start collecting real-time event monitoring logs in Microsoft Sentinel", "description": "Follow [Create a Connected App in Salesforce for OAuth](https://help.salesforce.com/s/articleView?id=platform.ev_relay_create_connected_app.htm&type=5) and [Configure a Connected App for the OAuth 2.0 Client Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_client_credentials_setup.htm&type=5) to create a Connected App with access to the Salesforce Event Monitoring API. Through those instructions, you should get the Consumer Key and Consumer Secret.\n For Salesforce Domain name, Go to Setup, type My Domain in the Quick Find box, and select My Domain to view your domain details. Make sure to enter the domain name without a trailing slash (e.g., https://your-domain.my.salesforce.com). Fill the form below with that information.", "instructions": [ { "type": "MessageBar", "parameters": { "text": "**Required Add-on subscription:** Your Salesforce account should include Salesforce Shield or Salesforce Event Monitoring add-on subscriptions for this connector to work.", "type": "warning" } } ] }, { "title": "Manage Salesforce Connections", "description": "Add, view, and delete Salesforce connections", "instructions": [ { "type": "DataConnectorsGrid", "parameters": { "mapping": [ { "columnName": "Connector Alias", "columnValue": "properties.addOnAttributes.friendlyName" }, { "columnName": "Salesforce Base URL", "columnValue": "properties.addOnAttributes.apiUrl" }, { "columnName": "Data Type", "columnValue": "properties.addOnAttributes.dataType" }, { "columnName": "Grant Type", "columnValue": "properties.addOnAttributes.grantType" } ], "menuItems": [ "DeleteConnector" ] } }, { "type": "ContextPane", "parameters": { "isPrimary": true, "label": "Add Connection", "title": "Configure API Connection", "subtitle": "Connect to Salesforce to ingest data", "contextPaneType": "DataConnectorsContextPane", "instructionSteps": [ { "title": "Base Configuration", "description": "Configure your Salesforce API connection", "instructions": [ { "type": "Textbox", "parameters": { "label": "Connection Alias", "placeholder": "Production or Sandbox", "type": "text", "name": "friendlyName", "validations": { "required": true } } }, { "type": "InfoMessage", "parameters": { "text": "Enter a unique alias to identify this Salesforce connection. **Important**: Use different aliases for each domain. To update an existing connection, use the same alias or delete and create with the same alias. To replace a connection, delete the old one and create a new one with a new alias.", "visible": true, "inline": true } }, { "type": "Dropdown", "parameters": { "label": "Query interval (in minutes)", "name": "queryWindow", "options": [ { "key": "5", "text": "5" }, { "key": "10", "text": "10" }, { "key": "15", "text": "15" }, { "key": "20", "text": "20" }, { "key": "30", "text": "30" }, { "key": "60", "text": "60" } ], "placeholder": "Select interval (e.g., 10)", "required": true } }, { "type": "Textbox", "parameters": { "label": "Salesforce Base URL", "placeholder": "Example: https://your-domain.my.salesforce.com", "type": "url", "name": "salesforceBaseUrl", "validations": { "required": true } } }, { "type": "InfoMessage", "parameters": { "text": "Enter the base URL of your Salesforce instance without trailing slash (e.g., https://your-domain.my.salesforce.com)", "visible": true, "inline": true } }, { "type": "Dropdown", "parameters": { "label": "Data Types", "name": "selectedDataTypes", "options": [ { "key": "ApiAnomalyEventStore", "text": "ApiAnomalyEventStore" }, { "key": "ApiEvent", "text": "ApiEvent" }, { "key": "BulkApiResultEventStore", "text": "BulkApiResultEventStore" }, { "key": "CredentialStuffingEventStore", "text": "CredentialStuffingEventStore" }, { "key": "FileEventStore", "text": "FileEventStore" }, { "key": "GuestUserAnomalyEventStore", "text": "GuestUserAnomalyEventStore" }, { "key": "IdentityVerificationEvent", "text": "IdentityVerificationEvent" }, { "key": "IdentityProviderEventStore", "text": "IdentityProviderEventStore" }, { "key": "LightningUriEvent", "text": "LightningUriEvent" }, { "key": "ListViewEvent", "text": "ListViewEvent" }, { "key": "LoginAnomalyEventStore", "text": "LoginAnomalyEventStore" }, { "key": "LoginAsEvent", "text": "LoginAsEvent" }, { "key": "LoginEvent", "text": "LoginEvent" }, { "key": "LogoutEvent", "text": "LogoutEvent" }, { "key": "PermissionSetEventStore", "text": "PermissionSetEventStore" }, { "key": "ReportAnomalyEventStore", "text": "ReportAnomalyEventStore" }, { "key": "ReportEvent", "text": "ReportEvent" }, { "key": "SessionHijackingEventStore", "text": "SessionHijackingEventStore" }, { "key": "UniversalAnomalyEventStore", "text": "UniversalAnomalyEventStore" }, { "key": "UriEvent", "text": "UriEvent" } ], "placeholder": "Select data types to collect...", "isMultiSelect": true, "defaultAllSelected": true, "required": true } } ] }, { "title": "OAuth2 Credentials", "description": "Configure OAuth2 credentials for API access", "instructions": [ { "type": "Markdown", "parameters": { "content": "### OAuth2 Client Credentials" } }, { "type": "InfoMessage", "parameters": { "text": "The Salesforce connector supports two types of OAuth2 client credentials flow to authenticate with all API endpoints - Client Credentials and Username-Password. These credentials provide access to the selected data stream.", "visible": true, "inline": true } }, { "type": "InfoMessage", "parameters": { "text": "**Important:** For legacy or classic setup, ensure that the security token is appended to your password for the password-based grant type authentication to work. For lightning, passing just the password should work. For more information, refer to the [OAuth 2.0 Username-Password Flow for Special Scenarios](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_username_password_flow.htm&type=5).", "visible": true, "inline": true } }, { "type": "Radio", "parameters": { "title": "Grant Type", "name": "salesforceGrantType", "validations": { "required": true }, "options": [ { "label": "Client Credentials", "value": "client_credentials", "instructions": [ { "type": "Textbox", "parameters": { "label": "Consumer Key", "placeholder": "Enter Connected App Consumer Key", "type": "text", "name": "clientId", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "Consumer Secret", "placeholder": "Enter Connected App Consumer Secret", "type": "password", "name": "clientSecret", "validations": { "required": true } } } ] }, { "label": "Password", "value": "password", "instructions": [ { "type": "Textbox", "parameters": { "label": "Consumer Key", "placeholder": "Enter Connected App Consumer Key", "type": "text", "name": "clientId", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "Consumer Secret", "placeholder": "Enter Connected App Consumer Secret", "type": "password", "name": "clientSecret", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "Username", "placeholder": "Enter your Salesforce username", "type": "text", "name": "username", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "Password", "placeholder": "Enter your Salesforce password", "type": "password", "name": "password", "validations": { "required": true } } } ] } ] } } ] } ] } } ] } ] } } }