Salesforce Event Collector

Details

ID	`Salesforce Event Collector`
Provider	Salesforce
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/py3-tools:1.0.0.94051`
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Deprecated. Use XSIAM/XDR Salesforce integration instead.

Configure Salesforce Event Collector in Cortex

Parameter	Description	Required
Server URL		True
Client ID		True
Client Secret		True
Username		True
Password		True
Query to get Hourly Event Log Files	For more information, visit the Query Hourly Event Log Files documentation https://developer.salesforce.com/docs/atlas.en-us.234.0.api_rest.meta/api_rest/event_log_file_hourly_query.htm	True
How many log files to fetch		True
First fetch time interval		False
Use system proxy settings		False
Trust any certificate (not secure)		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

salesforce-get-events

Manual command to fetch events.

Base Command

salesforce-get-events

Input

Argument Name	Description	Required
files_limit	The maximum number of log files to fetch. Default is 1.	Optional
should_push_events	Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False.	Required

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (required)
client_id — (required)
client_secret — (required)
credentials — Username (required)
query — Query to get Hourly Event Log Files (required)
files_limit — How many log files to fetch (required)
after — First fetch time interval
proxy — Use system proxy settings
verify — Trust any certificate (not secure)

Commands (1)

salesforce-get-events
Manual command to fetch events.

Source

SalesForceEventCollector.py SalesForceEventCollector.yml SalesForceEventCollector_description.md

Download History Raw

commonfields:
  id: Salesforce Event Collector
  version: -1
name: Salesforce Event Collector
display: Salesforce Event Collector (Deprecated)
category: Analytics & SIEM
provider: Salesforce
deprecated: true
description: Deprecated. Use Cortex XSIAM/XDR Salesforce integration instead.
configuration:
- display: Server URL
  name: url
  defaultvalue: 'https://um6.salesforce.com'
  type: 0
  required: true
- display: ""
  displaypassword: Client ID
  name: client_id
  type: 9
  required: true
  hiddenusername: true
- display: ""
  displaypassword: Client Secret
  name: client_secret
  type: 9
  required: true
  hiddenusername: true
- display: Username
  displaypassword: Password
  name: credentials
  type: 9
  required: true
- display: Query to get Hourly Event Log Files
  additionalinfo: For more information, visit the Query Hourly Event Log Files documentation https://developer.salesforce.com/docs/atlas.en-us.234.0.api_rest.meta/api_rest/event_log_file_hourly_query.htm
  name: query
  defaultvalue: "SELECT+Id+,+EventType+,+Interval+,+LogDate+,+LogFile+,+LogFileLength+FROM+EventLogFile+WHERE+Interval+=+'Hourly'"
  type: 12
  required: true
- display: How many log files to fetch
  name: files_limit
  type: 0
  defaultvalue: 1000
  required: true
- display: First fetch time interval
  name: after
  type: 0
  defaultvalue: 3 days
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Trust any certificate (not secure)
  name: verify
  type: 8
  required: false
script:
  script: ""
  type: python
  commands:
  - description: Manual command to fetch events.
    name: salesforce-get-events
    arguments:
    - name: files_limit
      defaultValue: 1
      description: 'The maximum number of log files to fetch.'
    - auto: PREDEFINED
      defaultValue: 'False'
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - 'True'
      - 'False'
      required: true
  dockerimage: demisto/py3-tools:1.0.0.94051
  isfetchevents: true
  subtype: python3
fromversion: 6.8.0
marketplaces:
- marketplacev2
tests:
- No tests
supportedModules:
- xsiam

Salesforce Event Collector Deprecated