Fortinet black logo

External Systems Configuration Guide

Salesforce CRM Audit

Salesforce CRM Audit

What is Discovered and Monitored

Protocol Logs Collected Used For
Salesforce API Successful/Failed Login, API Query Activity, Dashboard Activity, Opportunity Activity, Report Export Activity, Report Activity, Document Download Activity Security Monitoring

Event Types

In ADMIN > Device Support > Event Types, search for "Salesforce Audit" in the Search field to see the event types associated with this device.

Reports

There are many reports defined in RESOURCES > Reports > Device > Application > CRM

  • Salesforce Failed Logon Activity
  • Salesforce Successful Logon Activity
  • Top Browsers By Failed Login Count
  • Top Browsers By Successful Login Count
  • Top Salesforce Users By Failed Login Count
  • Top Salesforce Users By Successful Login Count
  • Top Successful Salesforce REST API Queries By Count, Run Time
  • Top Failed Salesforce Failed REST API Queries By Count, Run Time
  • Top Salesforce API Queries By Count, Run Time
  • Top Salesforce Apex Executions By Count, Run Time
  • Top Salesforce Dashboards Views By Count
  • Top Salesforce Document Downloads By Count
  • Top Salesforce Opportunity Reports By Count
  • Top Salesforce Report Exports By Count
  • Top Salesforce Reports By Count, Run Time
  • Top Salesforce Events

Configuration

Salesforce Configuration

Salesforce saves events in a SQL Database, where FortiSIEM will pull the following events from tables: EventLogFile, LoginHistory,User, Dashboard, Opportunity, Report through SQL commands.

If you get an error about missing columns, please make sure your administrator has enabled Set History Tracking for the missing columns in the tables.

For more information on how to enable Set History Tracking, please refer to https://help.salesforce.com/articleView?id=sf.updating_picklists.htm&type=5

The required columns are listed in this table.

Event Required Columns
EventLogFile Id, EventType, LogFile, LogDate, LogFileLength, LastModifiedDate, LastModifiedDate
LoginHistory Id, UserId, LoginTime, Browser, Platform, Status, SourceIp, LoginTime , LoginTime
Dashboard Id, Description, DeveloperName, FolderName, Title, LastModifiedDate, LastModifiedDate LastModifiedDate
Opportunity Id, Amount, CloseDate, Name, OwnerId, Type, LastModifiedDate, LastModifiedDate, LastModifiedDate
Report Id, Name

User

Id, Username

For example, if Type in Opportunity is not enabled in Set History Tracking, FortiSIEM will fail to get events in Opportunity.

Define Salesforce Audit Credential in FortiSIEM

Complete these steps in the FortiSIEM UI by first logging in to the FortiSIEM Supervisor node.

  1. Go to the ADMIN > Setup > Credentials tab.
  2. In Step 1: Enter Credentials:
    1. Follow the instructions in “Setting Credentials“ in the User's Guide to create a new credential.
    2. Enter these settings in the Access Method Definition dialog box and click Save:
    1. Settings Description
      Name Enter a name for the credential
      Device Type Salesforce Salesforce Audit
      Access Protocol Salesforce API
      Pull Interval 5 minutes
      Timeout 30 seconds

      Password config

      See Password Configuration

      User Name

      User name for device access

      Password

      Password for device access

      Security Token Security token
      Description Description of the device.
  • Create IP Range to Credential Association and Test Connectivity

    From the FortiSIEM Supervisor node, take the following steps (From ADMIN > Setup > Credentials).

    1. In Step 2: Enter IP Range to Credential Associations, click New.
      1. Enter "login.salesforce.com" in the IP/Host Name field.
      2. Select the name of the credential created in the "Define Salesforce Audit Credential in FortiSIEM" from the Credentials drop-down list.
      3. Click Save.
    2. Select the entry just created and click the Test drop-down list and select Test Connectivity without Ping. A pop up will appear and show the Test Connectivity results.
    3. Go to ADMIN > Setup > Pull Events and make sure an entry is created for Salesforce Audit Log Collection.

    Sample Events for Salesforce Audit

    [Salesforce_Activity_Perf]:[activityType]=API,[activityName]=get_user_info,[srcIpAddr]=23.23.13.166,[user]=user1.my@example.com,[deviceTime]=1458112097,[isSuccess]=false,[runTime]=31,[cpuTime]=9,[dbTime]=19434051,[infoURL]=Api

    Salesforce CRM Audit

    Salesforce CRM Audit

    What is Discovered and Monitored

    Protocol Logs Collected Used For
    Salesforce API Successful/Failed Login, API Query Activity, Dashboard Activity, Opportunity Activity, Report Export Activity, Report Activity, Document Download Activity Security Monitoring

    Event Types

    In ADMIN > Device Support > Event Types, search for "Salesforce Audit" in the Search field to see the event types associated with this device.

    Reports

    There are many reports defined in RESOURCES > Reports > Device > Application > CRM

    • Salesforce Failed Logon Activity
    • Salesforce Successful Logon Activity
    • Top Browsers By Failed Login Count
    • Top Browsers By Successful Login Count
    • Top Salesforce Users By Failed Login Count
    • Top Salesforce Users By Successful Login Count
    • Top Successful Salesforce REST API Queries By Count, Run Time
    • Top Failed Salesforce Failed REST API Queries By Count, Run Time
    • Top Salesforce API Queries By Count, Run Time
    • Top Salesforce Apex Executions By Count, Run Time
    • Top Salesforce Dashboards Views By Count
    • Top Salesforce Document Downloads By Count
    • Top Salesforce Opportunity Reports By Count
    • Top Salesforce Report Exports By Count
    • Top Salesforce Reports By Count, Run Time
    • Top Salesforce Events

    Configuration

    Salesforce Configuration

    Salesforce saves events in a SQL Database, where FortiSIEM will pull the following events from tables: EventLogFile, LoginHistory,User, Dashboard, Opportunity, Report through SQL commands.

    If you get an error about missing columns, please make sure your administrator has enabled Set History Tracking for the missing columns in the tables.

    For more information on how to enable Set History Tracking, please refer to https://help.salesforce.com/articleView?id=sf.updating_picklists.htm&type=5

    The required columns are listed in this table.

    Event Required Columns
    EventLogFile Id, EventType, LogFile, LogDate, LogFileLength, LastModifiedDate, LastModifiedDate
    LoginHistory Id, UserId, LoginTime, Browser, Platform, Status, SourceIp, LoginTime , LoginTime
    Dashboard Id, Description, DeveloperName, FolderName, Title, LastModifiedDate, LastModifiedDate LastModifiedDate
    Opportunity Id, Amount, CloseDate, Name, OwnerId, Type, LastModifiedDate, LastModifiedDate, LastModifiedDate
    Report Id, Name

    User

    Id, Username

    For example, if Type in Opportunity is not enabled in Set History Tracking, FortiSIEM will fail to get events in Opportunity.

    Define Salesforce Audit Credential in FortiSIEM

    Complete these steps in the FortiSIEM UI by first logging in to the FortiSIEM Supervisor node.

    1. Go to the ADMIN > Setup > Credentials tab.
    2. In Step 1: Enter Credentials:
      1. Follow the instructions in “Setting Credentials“ in the User's Guide to create a new credential.
      2. Enter these settings in the Access Method Definition dialog box and click Save:
    1. Settings Description
      Name Enter a name for the credential
      Device Type Salesforce Salesforce Audit
      Access Protocol Salesforce API
      Pull Interval 5 minutes
      Timeout 30 seconds

      Password config

      See Password Configuration

      User Name

      User name for device access

      Password

      Password for device access

      Security Token Security token
      Description Description of the device.
  • Create IP Range to Credential Association and Test Connectivity

    From the FortiSIEM Supervisor node, take the following steps (From ADMIN > Setup > Credentials).

    1. In Step 2: Enter IP Range to Credential Associations, click New.
      1. Enter "login.salesforce.com" in the IP/Host Name field.
      2. Select the name of the credential created in the "Define Salesforce Audit Credential in FortiSIEM" from the Credentials drop-down list.
      3. Click Save.
    2. Select the entry just created and click the Test drop-down list and select Test Connectivity without Ping. A pop up will appear and show the Test Connectivity results.
    3. Go to ADMIN > Setup > Pull Events and make sure an entry is created for Salesforce Audit Log Collection.

    Sample Events for Salesforce Audit

    [Salesforce_Activity_Perf]:[activityType]=API,[activityName]=get_user_info,[srcIpAddr]=23.23.13.166,[user]=user1.my@example.com,[deviceTime]=1458112097,[isSuccess]=false,[runTime]=31,[cpuTime]=9,[dbTime]=19434051,[infoURL]=Api