Salesforce Monitoring

Configuration Guide

Updated Feb 16, 2023

Salesforce Monitoring

Salesforce cloud monitoring Direct link to this section

Arctic Wolf® can use the Salesforce API to monitor Salesforce audit logs and alert you about suspicious or malicious activity.

To implement this monitoring, you must provide the following information about the SalesForce API to Arctic Wolf:

Salesforce cloud monitoring limitations Direct link to this section

Requirements Direct link to this section

Configure Salesforce monitoring Direct link to this section

  1. Create a new user for log collection.
  2. Create a security token for the user.
  3. Assign permissions to the profile.
  4. Provide credentials to Arctic Wolf.

1. Create a new user for log collection Direct link to this section

Arctic Wolf strongly recommends that you create a new Salesforce administrative user for log collection and forwarding to the Arctic Wolf Sensor. Having a dedicated user limits access to the permissions that the Arctic Wolf Sensor requires, and allows for better visibility over Arctic Wolf Sensor activities.

Note: If you choose to use an existing Salesforce user instead of creating a new one, confirm that you have access to both the username and password of the user and proceed to Create a security token for the user.

To create a new Salesforce administrative user:

  1. Sign in to Salesforce as a system administrator.

  2. From the Salesforce portal, navigate to Setup > Manage Users > Users.

  3. Click New User and complete the following fields:

    1. Enter the required user details, including email address.

    2. In the User License field, select Salesforce.

    3. In the Profile field, select System Administrator.

    4. Select Generate new password and notify user immediately.

    5. Click Save.

  4. Sign out of Salesforce.

  5. Follow the steps in the email sent to the email address entered for your new user. Make sure to click Verify.

2. Create a security token for the user Direct link to this section

Based on your action in Create a new user for log collection, you can either create a new security token for a user or reuse a token for an existing user.

Note: If you do not have access to the existing security token, you must create a new one. Creating a new security token invalidates any previous token. Therefore, if you need to create a new security token, verify that nothing is using the existing token.

To create a new security token for the user:

  1. Sign in to Salesforce as the user.

  2. Navigate to Settings > My Personal Information > Reset My Security Token.

  3. Select Reset Security Token. This sends the new security token to the email address of the user.

  4. Retrieve the token from the email, and save the email in a secure place for possible future use.

3. Assign permissions to the profile Direct link to this section

You need to assign the required permissions to the profile associated with the new system adminstrator. Arctic Wolf recommends creating a new profile to provide greater isolation and visibility for the additional permissions.

Note: If you choose to update an existing profile instead if creating a new one, be aware of how the additional permissions granted could affect other users sharing that profile.

To add the required permissions to the profile:

  1. Select Settings > My Personal Information > Advanced User Details.

  2. Click the Profile name, such as System Administrator.

    Profile name selected

  3. Edit or clone the profile:

    • To update the existing profile, select Edit.
    • To create a new profile, select Clone.

    Edit and Clone buttons

  4. Under Administrative Permissions, select:

    • API Enabled

    • View All Data

    • View Setup and Configuration

    • Manage Users

      Tip: This lets Arctic Wolf retrieve LoginHistory events for all Salesforce users.

    • Password Never Expires

      Tip: If the password on the account changes, the security token is invalidated and needs to be reset. If this happens, contact your Concierge Security® Team (CST) with the updated password and security token. Arctic Wolf is unable to monitor logs in your Salesforce account until new values are received.

    Note: Selecting these options automatically includes relevant subcategories of permissions. For example, enabling Manage Users automatically applies permissions to reset user credentials and lock accounts.

4. Provide credentials to Arctic Wolf Direct link to this section

To provide the Salesforce username, and the associated password and security token to Arctic Wolf:

  1. Sign in to the Arctic Wolf Portal.

  2. Select Connected Accounts in the banner menu to open the Connected Accounts page.

    Connected Accounts menu

  3. Select +Add Account to open the Add Account form.

  4. Select Cloud Detection and Response as the Account Type.

  5. Select Salesforce from the list of cloud services, and fill in the form:

    1. In the Account Name field, specify a descriptive name for the credentials.

    2. Enter the sign-in credentials for your organization in the Username and Password fields.

    3. Copy the security token from the previous email into the Security Token field.

  6. Select Submit to CST.

  7. When prompted with the confirmation message, review your submission, and then select Done. You are returned to the Connected Accounts page.

  8. Verify that the newly-submitted credential entry appears in the cloud services list with the status Connection Pending.

After your Concierge Security® Team provisions security monitoring for your account, the status of your credentials changes to Connected.