elastic / elastic/integrations
[salesforce] Add support for security-relevant events
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
# Description
We could collect several security-relevant events via Salesforce's [real-time event monitoring](https://help.salesforce.com/s/articleView?id=xcloud.real_time_event_monitoring_streaming.htm&type=5) data stream:
- Threat Detection events: CredentialStuffingEvent, GuestUserAnomalyEvent, SessionHijackingEvent, ApiAnomalyEvent, LoginAnomalyEvent
- Data Access & Exfiltration events: BulkApiResultEvent, ReportEventStream, FileEvent, etc
- Permission & Configuration Changes: PermissionSetEvent
- API Execution: ApiEventStream
- SearchClick
- ReportExport
- DocumentAttachedDownloads
- ContentTransfer
- Report(Event)
- Search(Event)
- EventLogFile SOAP API
- EventLogFile Aura Request
Sample data available upon request.
Contributor guide
Assessment
This issue has not been assessed yet.