Configure Salesforce for Arctic Wolf monitoring

You can configure Salesforce® cloud to send the necessary logs to Arctic Wolf® for security monitoring.

Arctic Wolf only supports Salesforce monitoring when SSO and MFA are enabled at the organization level for Salesforce sign-ins.

If you have the Group Edition of Salesforce or enable SSO and MFA enforcement at the permission set or profile levels, Arctic Wolf cannot monitor the integration. For example, these enforcement methods are not supported:

• MFA enforced through the Multi-Factor Authentication for API Logins permission.

• MFA enforced by setting the Session Security Level Required at Login for a profile to High Assurance.

• SSO enforced through the Is Single Sign-On Enabled permission.

  See Salesforce MFA FAQ for more information about these features.

Requirements

• System administrator permissions for the Salesforce organization you want Arctic Wolf to monitor.
• Integration API access. If your organization uses the Professional Edition of Salesforce, you can purchase the required API access from Salesforce for an additional fee. Contact your Salesforce account executive to enable this functionality.

  Note: The required integration APIs are enabled automatically in the Enterprise, Unlimited, and Performance editions of Salesforce.

Before you begin

• Verify with your Salesforce administrator that Arctic Wolf API usage rates will not exceed your API request limit for your organization.

  For more information about Salesforce API request limits, see API Request Limits and Allocations.

Steps

1. Create or select a Salesforce profile.
2. Create a new user for log collection.
3. Create a security token for the user.
4. Provide your Salesforce cloud credentials to Arctic Wolf.

Step 1: Create or select a Salesforce profile

Do one of these options:

• Create a new profile:

  1. Sign in to Salesforce with administrator permissions.

  2. In the Salesforce portal, click Setup > Manage Users > Profiles.

  3. Click New Profile, and then complete these steps:

     1. In the Existing Profile list, select Minimum Access - Salesforce.
     2. In the Profile Name field, enter a name for the profile.
     3. Click Save.

  4. On the new profile page, click Edit.

  5. In the Administrative Permissions section, select these permissions:

     • API Enabled

     • Manage Data Integrations

     • Manage Users

     • Password Never Expires

       Note: If the password on the account changes, the security token is invalidated and needs to be reset. If this happens, contact your Concierge Security® Team (CST) and include the updated password and security token. Arctic Wolf is unable to monitor logs in your Salesforce account until new values are received.

     • View Setup and Configuration

     Note: Selecting these permissions automatically enables the relevant subcategories. For example, selecting Manage Users automatically enables permissions to manage internal users and manage roles.

  6. Click Save.

• Choose an existing profile:
  1. Make sure that you have the password and username of the user.
  2. Add these administrative permissions for the user:

     • API Enabled

     • Manage Data Integrations

     • Manage Users

     • Password Never Expires

       Note: If the password on the account changes, the security token is invalidated and needs to be reset. If this happens, contact your Concierge Security® Team (CST) and include the updated password and security token. Arctic Wolf is unable to monitor logs in your Salesforce account until new values are received.

     • View Setup and Configuration

  3. Proceed to Create a security token for the user.

Step 2: Create a new user for log collection

If you want to create a new user for log collection:

1. Sign in to Salesforce with administrator permissions.
2. Click Setup > Manage Users > Users.
3. Click New User, and then configure these settings:

   • First Name and Last Name — Enter a name for the service user.

     The Alias field automatically populates.

   • Email — Enter the email associated with the user.

   • Nickname — Enter a nickname for the user. For example, Arctic Wolf log collection.

   • Role — If you want to assign a specific role, select that role. If not, select .

   • User License — Select Salesforce.

   • Profile — Select the profile created in Create a new Salesforce profile.

   • Configure the remaining required fields.

   • Generate new password and notify user immediately — Select the checkbox.

     A verification email is sent to the address of new user with the subject, Welcome to Salesforce: Verify your account.

4. Click Save.
5. Sign out of Salesforce.
6. Complete the steps in the verification email sent to the new user.
7. Click Verify.

Step 3: Create a security token for the user

If you created a new user or profile or you do not have access to the existing security token for the existing user, create a new security token:

1. Sign in to Salesforce as the user you want to use for log collection.

2. Click Settings > Personal > Reset My Security Token.

3. Select Reset Security Token.

   The new security token is sent to the email address of the user.

4. Copy the token from the email, and then save it in a safe, encrypted location. You will provide it to Arctic Wolf later.

Step 4: Provide your Salesforce cloud credentials to Arctic Wolf

1. Sign in to the Arctic Wolf Unified Portal.

2. Click Telemetry Management > Connected Accounts.

3. Click Add Account +.

4. On the Add Account page, in the Account Type list, select Cloud Detection and Response.

5. Configure these settings:

   • Account Name — Enter a unique and descriptive name for the account.

   • Username — Enter the username for your user.

   • Password — Enter the password for your user.

   • Security Token — Enter the security token from Create a security token for the user.

   • Salesforce Authentication Domain — If your credentials are for a Salesforce Sandbox environment, select test. Otherwise, select login.

     For more information about Salesforce Sandboxes, see Salesforce documentation.

   • Credential Expiry — (Optional) Enter the credential expiration date, if applicable.

6. Click Test and submit credentials.

See also

• API Request Limits and Allocations
• Salesforce MFA FAQ