elastic / elastic/integrations

[salesforce] Add support for security-relevant events

Open
#15,659 2 comments 0 reactions 0 assignees View on GitHub
enhancement Integration:salesforce Team:Obs-InfraObs
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

# Description
We could collect several security-relevant events via Salesforce's [real-time event monitoring](https://help.salesforce.com/s/articleView?id=xcloud.real_time_event_monitoring_streaming.htm&type=5) data stream:

- Threat Detection events: CredentialStuffingEvent, GuestUserAnomalyEvent, SessionHijackingEvent, ApiAnomalyEvent, LoginAnomalyEvent
- Data Access & Exfiltration events: BulkApiResultEvent, ReportEventStream, FileEvent, etc
- Permission & Configuration Changes: PermissionSetEvent
- API Execution: ApiEventStream
- SearchClick
- ReportExport
- DocumentAttachedDownloads
- ContentTransfer
- Report(Event)
- Search(Event)
- EventLogFile SOAP API
- EventLogFile Aura Request

Sample data available upon request.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.