elastic / elastic/integrations
[salesforce] Add security events from real-time event monitoring
Open
enhancement
Integration:salesforce
Team:Security-Service Integrations
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 225
Description
# Description
Salesforce has several security-relevant events in [Real-Time Event Monitoring](https://help.salesforce.com/s/articleView?id=xcloud.real_time_event_monitoring_streaming.htm&type=5) we could add to the integration:
- Threat Detection Events: CredentialStuffingEvent, GuestUserAnomalyEvent, SessionHijackingEvent, ApiAnomalyEvent, LoginAnomalyEvent
- Data Access & Exfiltration Events: BulkApiResultEvent, ReportEventStream, FileEvent, etc
- Permission & Configuration Changes: PermissionSetEvent
- API Execution: ApiEventStream
Samples available upon request.
Contributor guide
Assessment
This issue has not been assessed yet.