Salesforce

Overview

Use the Salesforce integration to search, query, and add new objects (tasks, accounts, cases, and so on) to Salesforce directly from Cortex XSOAR.

Support Salesforce API Version 63.0.

The fetch incident option enables you to monitor the creation of new Salesforce cases and manage them in Cortex XSOAR.

Use cases

Search for data: !salesforce-search pattern=”1234”

This command will return all relevant objects containing the string 1234 as a part of their data.

Querying the data base: !salesforce-query query=“SELECT Subject,Description FROM User WHERE CreatedDate>2018-01-01T00:00:00Z”

This command will return the subject and description of all cases that were created in 2018.

Creating Cases: !salesforce-add-case status="On Hold" subject="adding case from command add-case" type="Feature Request" priority=Low

This command will create a new Salesforce case with the given data.

Submitting Chatter message: !salesforce-push-comment oid=5003600000Smg4sAAB text="adding comment to case" link="google.com"

This command will add a new comment to the object oid and result with the following comment.

Configure Salesforce to Work with Cortex XSOAR

1. Add a new connected App in Salesforce. For more information, see the Salesforce documentation.
2. If you already have a connected App, navigate to Setup > App Manager and select the correct App from the list, and click View.
3. You can find the Consumer Key / Secret under API (Enable OAuth Settings).
   For detailed instructions see the Credentials walkthrough section.

Configure the Salesforce Integration on Cortex XSOAR

1. Navigate to Settings > Integrations > Servers `&` Services.
2. Search for Salesforce.
3. Click Add instance to create and configure a new integration instance.
   
   • Name: a textual name for the integration instance.
   • Instance URL: A URL to the instance.
   • Credentials: The username for accessing the instance
   • Consumer Key: The Consumer Key set for this integration with Cortex XSOAR, as explained in 'Setting Salesforce'
   • Consumer Secret: The Consumer Secret set for this integration with Cortex XSOAR, as explained in 'Setting Salesforce' above.
   • Trust any certificate (not secure)
   • Fetch type: cases/comments (Only fetch comments when using the SalesforceAskUser automation)
   • Use system proxy settings
   • Fetch incidents
   • Incident type
4. Click Test to validate the URLs, token, and connection.

Fetched Incidents Data

The fetch command monitors the creation of new cases starting from the time the option was enabled.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

1. Search Salesforce records: salesforce-search
2. Perform a query using SOQL: salesforce-query
3. Get an object: salesforce-get-object
4. Update an object: salesforce-update-object
5. Create an object: salesforce-create-object
6. Add a comment to chatter: salesforce-push-comment
7. Get case information: salesforce-get-case
8. Create a case: salesforce-create-case
9. Update a case: salesforce-update-case
10. Get all cases: salesforce-get-cases
11. Close a case: salesforce-close-case
12. Add a comment to a chatter thread: salesforce-push-comment-threads
13. Delete a case: salesforce-delete-case

1. Search Salesforce records

Search records that contain values with pattern.

Base Command

salesforce-search

Input

Context Output

2. Perform a query using SOQL

Query Salesforce with SOQL

Base Command

salesforce-query

Input

Context Output

There is no context output for this command.

Command Example

3. Get an object

Get object by path

Base Command

salesforce-get-object

Input

Context Output

Command Example

Context Example

Human Readable Output

4. Update an object

Update object fields

Base Command

salesforce-update-object

Input

Context Output

5. Create an object

Create new object

Base Command

salesforce-create-object

Input

Context Output

6. Add a comment to chatter

Add a comment to chatter

Base Command

salesforce-push-comment

Input

Context Output

Command Example

Context Example

7. Get case information

Get information for a specified on a case. All arguments are optional, but you must specify at least one for the command to execute successfully.

Base Command

salesforce-get-case

Input

Context Output

Command Example

Context Example

8. Create a case

Create a new case

Base Command

salesforce-create-case

Input

Context Output

9. Update a case

Update case fields

Base Command

salesforce-update-case

Input

Context Output

10. Get all cases

Get all cases

Base Command

salesforce-get-cases

Input

There is no input for this command.

Context Output

There is no context output for this command.

11. Close a case

Close a case

Base Command

salesforce-close-case

Input

Context Output

Command Example

12. Add a comment to a chatter thread

Add the comment to the chatter thread. Use this command only after salesforce-push-comment

Base Command

salesforce-push-comment-threads

Input

Context Output

13. Delete a case

Delete a specified on a case. All arguments are optional, but you must specify at least one for the command to execute successfully.

Base Command

salesforce-get-case

Input

Troubleshooting

Connection error:

• This error indicates that there is a problem with the credentials or the IP connection to the app (see step 6-7 in Credentials walkthrough below).

   
  
  
• This error indicates a problem in the Costumer Key:
  
   
  
  
• This error indicates a problem in the Costumer Secret:
  
   
   

Credentials walkthrough:

 1. Open Setup.

 

2. Go to the App manager on the left side menu (use Quick Find for faster search).
 

3. Click “New Connected App” on the right side of the screen.

4. Fill in the form as follows:

• Mark “Enable OAuth Settings”.
• In “Selected OAuth Scopes”, Add the following:
  • Access and manage your Chatter data (chatter_api)
  • Access and manage your data (api)

5. Click “Save” at the bottom of the form.

6. In the information page on the APP that you will be forwarded to locate “API (Enable OAuth Settings)” and copy the consumer key and secret to the integration instance configuration.

6. Go to “Manage Connected Apps”.

7. Edit the new application and under “OAuth Policies” enable all IP address.

salesforce-get-casecomment

Returns a comment through the case number.

Base Command

salesforce-get-casecomment

Input

Context Output

salesforce-post-casecomment

The post comment through the case number.

Base Command

salesforce-post-casecomment

Input

Context Output

There is no context output for this command.

salesforce-get-user

Returns the UserName through the case number.

Base Command

salesforce-get-user

Input

Context Output

salesforce-get-org

Returns organization details from the case number.

Base Command

salesforce-get-org

Input

Context Output

salesforce-file-delete

Soft-deletes a file (ContentDocument), moving it to the Recycle Bin and cascading to its versions. Recoverable for 15 days.

Base Command

salesforce-file-delete

Input

Context Output

Command example

!salesforce-file-delete id=069dn000007JlATAA0

Context Example

{
    "SalesForce": {
        "Remediation": {
            "Action": "Delete File",
            "Id": "069dn000007JlATAA0",
            "ObjectType": "ContentDocument",
            "Status": "Deleted"
        }
    }
}

Human Readable Output

Salesforce Remediation - Delete File

Action	Id	ObjectType	Status
Delete File	069dn000007JlATAA0	ContentDocument	Deleted

salesforce-knowledge-article-archive

Archives a Knowledge article (non-destructive). Sets PublishStatus to Archived via the standard archiveKnowledgeArticles action. Reversible to Draft/Online.

Base Command

salesforce-knowledge-article-archive

Input

Context Output

Command example

!salesforce-knowledge-article-archive id=ka1dn0000001ZwbAAE

Context Example

{
    "SalesForce": {
        "Remediation": {
            "Action": "Archive Knowledge Article",
            "Id": "ka1dn0000001ZwbAAE",
            "ObjectType": "KnowledgeArticleVersion",
            "Status": "Archived"
        }
    }
}

Human Readable Output

Salesforce Remediation - Archive Knowledge Article

Action	Id	ObjectType	Status
Archive Knowledge Article	ka1dn0000001ZwbAAE	KnowledgeArticleVersion	Archived

salesforce-file-public-link-list

Lists all public links (ContentDistribution records) for a given ContentDocument ID. Use the returned ContentDistribution IDs with salesforce-file-public-link-remove to remove each link.

Base Command

salesforce-file-public-link-list

Input

Context Output

Command example

!salesforce-file-public-link-list id=069dn000007PpOIAA0

Context Example

{
    "SalesForce": {
        "ContentDistribution": {
            "ContentDocumentId": "069dn000007PpOIAA0",
            "Id": "05Ddn000000VfWjEAK",
            "Name": "cortex-test-file-01 7/28/2026",
            "PublicUrl": "https://paloaltonetworks-sahil.sandbox.my.salesforce.com/sfc/p/7X000001T5lm/a/dn000000VfWj/TExjFQ7nttSYbbnXER8CaxGLqYDmVhzw2LEe1jg9_Vo"
        }
    }
}

Human Readable Output

Salesforce File Public Links (ContentDistribution) for 069dn000007PpOIAA0

ContentDocumentId	Id	Name	PublicUrl
069dn000007PpOIAA0	05Ddn000000VfWjEAK	cortex-test-file-01 7/28/2026	https://paloaltonetworks-sahil.sandbox.my.salesforce.com/sfc/p/7X000001T5lm/a/dn000000VfWj/TExjFQ7nttSYbbnXER8CaxGLqYDmVhzw2LEe1jg9_Vo

salesforce-file-public-link-remove

Removes a file public link by deleting a single ContentDistribution record. The external link is severed immediately and irreversibly.

Base Command

salesforce-file-public-link-remove

Input

Context Output

Command example

!salesforce-file-public-link-remove id=05Ddn000000VfWjEAK

Context Example

{
    "SalesForce": {
        "Remediation": {
            "Action": "Remove File Public Link",
            "Id": "05Ddn000000VfWjEAK",
            "ObjectType": "ContentDistribution",
            "Status": "Deleted"
        }
    }
}

Human Readable Output

Salesforce Remediation - Remove File Public Link

Action	Id	ObjectType	Status
Remove File Public Link	05Ddn000000VfWjEAK	ContentDistribution	Deleted

salesforce-knowledge-article-draft-create

Moves a published Knowledge article to Draft using the standard createDraftFromOnlineKnowledgeArticle action. By default (unpublish=true) the online version is removed from public visibility and an editable draft is created.

Base Command

salesforce-knowledge-article-draft-create

Input

Context Output

Command example

!salesforce-knowledge-article-draft-create id=ka1dn0000001ZyDAAU unpublish=true

Context Example

{
    "SalesForce": {
        "Remediation": {
            "Action": "Draft Knowledge Article",
            "DraftVersionId": "ka1dn0000001ZzpAAE",
            "Id": "ka1dn0000001ZyDAAU",
            "ObjectType": "KnowledgeArticleVersion",
            "Status": "Unpublished (Draft created)",
            "Unpublished": true
        }
    }
}

Human Readable Output

Salesforce Remediation - Draft Knowledge Article

Action	DraftVersionId	Id	ObjectType	Status	Unpublished
Draft Knowledge Article	ka1dn0000001ZzpAAE	ka1dn0000001ZyDAAU	KnowledgeArticleVersion	Unpublished (Draft created)	true

<~PLATFORM>

License Requirements

The following configuration parameters require one of these licenses: Cortex XSIAM or Agentix:

• Fetch incidents

</~PLATFORM>