Collect Salesforce logs

This document explains how to collect Salesforce logs by setting up a Google Security Operations feed using the Third Party API.

Salesforce is a cloud-based customer relationship management (CRM) platform that provides tools for sales, service, marketing, and analytics. Salesforce logs capture user activity, security events, system changes, and API usage across the platform.

Before you begin

Ensure that you have the following prerequisites:

• A Google SecOps instance
• Salesforce Enterprise Edition or higher (API access enabled)
• Salesforce System Administrator permissions
• OpenSSL installed (for certificate generation)

Generate RSA key pair and certificate

Generate an RSA private key and self-signed X.509 certificate for JWT signing.

Generate private key

 ```bash
openssl genrsa -out salesforce_private.key 2048
``` 

Generate self-signed certificate

 ```bash
openssl req -new -x509 -key salesforce_private.key -out salesforce_certificate.crt -days 365
``` 

When prompted, enter certificate details:

• Country Name: Enter your 2-letter country code (for example, US ).
• State or Province Name: Enter your state (for example, California ).
• Locality Name: Enter your city (for example, San Francisco ).
• Organization Name: Enter your organization name (for example, Acme Corp ).
• Organizational Unit Name: Enter department (for example, IT Security ).
• Common Name: Enter a descriptive name (for example, Chronicle Integration ).
• Email Address: Enter contact email.

Create Salesforce External Client App

External Client Apps are the recommended method for OAuth authentication in Salesforce (Spring '26 and later).

1. Sign in to Salesforce.
2. Go to Setup(gear icon in top right).
3. In the Quick Findbox, enter External Client Apps .
4. Click External Client App Manager.
5. Click New External Client App.

Configure basic information

1. Provide the following configuration details:
   • External Client App Name: Enter a descriptive name (for example, Google SecOps Integration ).
   • API Name: Auto-populated based on app name. Leave as default or customize.
   • Contact Email: Enter your email address.
   • Distribution State: Select Local.
2. Click Continue.

Enable OAuth settings

1. Select the Enable OAuthcheckbox.
2. Provide the following configuration details:
   • Callback URL: Enter https://login.salesforce.com/services/oauth2/callback .

1. In the OAuth Scopessection, move the following scopes from Available OAuth Scopesto Selected OAuth Scopes:
   • Manage user data via APIs (api)
   • Perform requests on your behalf at any time (refresh_token, offline_access)

Enable JWT Bearer Flow and upload certificate

1. In the Flow Enablementsection, select the Enable JWT Bearer Flowcheckbox.
2. The Certificate Uploadsection appears.
3. Click Upload Filesor drag and drop your certificate file.
4. Select the salesforce_certificate.crt file generated earlier.
5. Wait for the upload to complete. The certificate filename should appear below the upload button.

Configure OAuth policies

1. In the OAuth Policiessection:
   • Permitted Users: Select Admin approved users are pre-authorized.
2. Click Save.

Get Consumer Key

After creating the External Client App, retrieve the Consumer Key for Chronicle configuration.

1. In the External Client App Manager, click on your app name (for example, Google SecOps Integration ).
2. Go to the Settingstab.
3. In the OAuth Settingssection, click Consumer Key and Secret.
4. Copy and save the Consumer Keyvalue.

Example Consumer Key format:

  ``` 
3MVG9IKcPoNiNVBIPjdw4z.pcfRjTFBp7xC8x9k4U8jZ0HlLQdPqX5bKjR8yNzQ9_YvY.8xD3F2W6nXb5YgNx ``` 
 

Pre-authorize the External Client App

Salesforce requires pre-authorization for JWT Bearer Flow. Pre-authorize by assigning the External Client App to a user via permission set.

Create permission set

1. Go to Setup > Users > Permission Sets.
2. Click New.
3. Provide the following configuration details:
   • Label: Enter Chronicle Integration Users (for example).
   • API Name: Auto-populated based on label.
4. Click Save.

Assign permission set to External Client App

1. Go to Setup > External Client App Manager.
2. Click on your External Client App (for example, Google SecOps Integration ).
3. Click the Policiestab.
4. In the App Policiessection, under Select Permission Sets:
   1. Move your permission set (for example, Chronicle Integration Users ) from Available Permission Setsto Selected Permission Sets.
5. Click Save.

Assign permission set to user

1. From the permission set detail page, click Manage Assignments.
2. Click Add Assignments.
3. Select the checkbox next to the user account that will be used for Chronicle integration (for example, integration@acme.com ).
4. Click Assign.
5. Click Done.

Configure a feed in Google SecOps to ingest Salesforce logs

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. On the next page, click Configure a single feed.
4. In the Feed namefield, enter a name for the feed (for example, Salesforce EventLogFile ).
5. Select Third Party APIas the Source type.
6. Select SALESFORCEas the Log type.
7. Click Next.
8. Specify values for the following input parameters:
   • API Hostname: Enter your Salesforce instance hostname (for example, acme.my.salesforce.com ).

  * 
  
 ** 
 OAuth 
  
 JWT 
  
 Endpoint 
 ** 
 : 
  
 Enter 
  
 the 
  
 OAuth 
  
 token 
  
 endpoint 
  
 URL 
 : 
  
 - 
  
 Production 
  
 orgs 
 : 
  
 ` 
 https 
 : 
 // 
 login 
 . 
 salesforce 
 . 
 com 
 / 
 services 
 / 
 oauth2 
 / 
 token 
 ` 
  
 - 
  
 Sandbox 
  
 orgs 
 : 
  
 ` 
 https 
 : 
 // 
 test 
 . 
 salesforce 
 . 
 com 
 / 
 services 
 / 
 oauth2 
 / 
 token 
 ` 
  
 - 
  
 My 
  
 Domain 
 : 
  
 ` 
 https 
 : 
 // 
 acme 
 . 
 my 
 . 
 salesforce 
 . 
 com 
 / 
 services 
 / 
 oauth2 
 / 
 token 
 ` 
 * 
  
 ** 
 JWT 
  
 Claims 
  
 Issuer 
 ** 
 : 
  
 Enter 
  
 the 
  
 Consumer 
  
 Key 
  
 from 
  
 the 
  
 External 
  
 Client 
  
 App 
 . 
 * 
  
 ** 
 JWT 
  
 Claims 
  
 Subject 
 ** 
 : 
  
 Enter 
  
 the 
  
 Salesforce 
  
 username 
  
 of 
  
 the 
  
 pre 
 - 
 authorized 
  
 user 
  
 ( 
 for 
  
 example 
 , 
  
 ` 
 integration 
 @acme 
 . 
 com 
 ` 
 ). 
 * 
  
 ** 
 JWT 
  
 Claims 
  
 Audience 
 ** 
 : 
  
 Enter 
  
 the 
  
 authorization 
  
 server 
  
 URL 
 : 
  
 - 
  
 Production 
  
 orgs 
 : 
  
 ` 
 https 
 : 
 // 
 login 
 . 
 salesforce 
 . 
 com 
 ` 
  
 - 
  
 Sandbox 
  
 orgs 
 : 
  
 ` 
 https 
 : 
 // 
 test 
 . 
 salesforce 
 . 
 com 
 ` 
  
 - 
  
 My 
  
 Domain 
 : 
  
 ` 
 https 
 : 
 // 
 acme 
 . 
 my 
 . 
 salesforce 
 . 
 com 
 ` 
 * 
  
 ** 
 RSA 
  
 Private 
  
 Key 
 ** 
 : 
  
 Paste 
  
 the 
  
 complete 
  
 private 
  
 key 
  
 contents 
  
 including 
  
 ` 
 -----BEGIN PRIVATE KEY-----` and `-----END PRIVATE KEY-----` markers. 
 

To get the private key contents:

 ```bash
cat salesforce_private.key
``` 

Copy the entire output including the header and footer lines.

  * 
  
 ** 
 Asset 
  
 namespace 
 **: 
  
 The 
  
 [ 
 asset 
  
 namespace 
 ]( 
 / 
 chronicle 
 / 
 docs 
 / 
 investigation 
 / 
 asset 
 - 
 namespaces 
 ). 
 * 
  
 ** 
 Ingestion 
  
 labels 
 **: 
  
 The 
  
 label 
  
 to 
  
 be 
  
 applied 
  
 to 
  
 the 
  
 events 
  
 from 
  
 this 
  
 feed 
 . 
 

1. Click Next.
2. Review your new feed configuration in the Finalizescreen, and then click Submit.

Salesforce instance types reference

The OAuth JWT endpoint and audience values depend on your Salesforce instance type:

 | Instance Type       | OAuth JWT Endpoint                                      | JWT Claims Audience              | API Hostname Format                    |
| ------------------- | ------------------------------------------------------- | -------------------------------- | -------------------------------------- |
| **Production**      | `https://login.salesforce.com/services/oauth2/token` 
| `https://login.salesforce.com` 
| `company.my.salesforce.com` 
|
| **Sandbox**         | `https://test.salesforce.com/services/oauth2/token` 
| `https://test.salesforce.com` 
| `company--sandbox.sandbox.my.salesforce.com` 
|
| **My Domain**       | `https://domain.my.salesforce.com/services/oauth2/token` 
| `https://domain.my.salesforce.com` 
| `domain.my.salesforce.com` 
|

Note: "My Domain" is recommended for production deployments. "My Domain" provides a custom, branded login URL and is required for certain Salesforce features. 

UDM mapping table

Need more help? Get answers from Community members and Google SecOps professionals.