Breadcrumbs

Initialize the Salesforce Audit Beat

This guide outlines the procedure to initialize the Salesforce Audit Beat configuration using the Open Collector.

Prerequisites

  • Acquire a Client ID and Client Secret, as outlined in Configure the Salesforce Portal.

  • Ensure that System Monitor System Monitor version 7.21 or higher is installed, with JSON parsing enabled. For more information on enabling JSON parsing, refer to Configure Beats for JSON Parsing.

  • The following port must be open:

Direction

Port

Protocol

Source

Outbound

443

HTTPS

Salesforce Audit Beat

Initialize the Beat via the Web Console (Recommended)

  1. Ensure that the Open Collector Connection to the SIEM (WebUI) setup has been completed.

  2. Ensure that the System Monitor Agent to which you intend to send these logs has been Configured for JSON Parsing.

Use either the Enable JSON Parsing on System Monitor Agents or the Enable JSON Parsing for an Existing System Monitor Agent sections at the above link to configure the System Monitor Agent for JSON Parsing.

  1. Follow the steps outlined in Add a Beat in the Web Console to create the Beat via the Web UI.

Initialize the Beat via Command Line (Legacy)

  1. Start the beat:

    ./lrctl salesforceauditbeat start

  2. Use the Up and Down Arrow keys to select New salesforceauditbeat instance from the list, and then press Enter.

  3. Enter the unique identifier for this salesforceauditbeat instance, and then press Enter.

  4. Enter your Salesforce Base URL, and then press Enter.

  5. Enter the Client ID, and then press Enter.

  6. Enter the Client Secret, and then press Enter.

  7. Enter the comma separated Log/Event Types you wish to collect, and then press Enter.
    Several log/event types are displayed by default. To fetch all types, simply press Enter, or remove or add specific types from the list to target particular data.

  8. Enter the Number of Back Days data is to be retrieved, and then press Enter.
    The minimum value is 0, and the maximum is 30.

  9. Enter the limit on number of results to fetch in single API call, and then press Enter.
    The default is 1000 events, with a minimum of 250 and a maximum of 3000.

  10. Enter the hostname or IP address of the System Monitor Agent that has been Configured for JSON Parsing, and then press Enter.

Use either the Enable JSON Parsing on System Monitor Agents or the Enable JSON Parsing for an Existing System Monitor Agent sections at the above link to configure the System Monitor Agent for JSON Parsing.

  1. Enter the port on which the System Monitor Agent is configured to listen for JSON data (the default is 5044), and then press Enter.
    The salesforceauditbeat service started message appears.

  2. Check the status of the service to confirm that it’s running:

    ./lrctl salesforceauditbeat status

  3. (Optional) Edit the salesforceauditbeat configuration to update the values set above if needed. Ensure that you have all the needed information for each step available as you will need to re-enter it:

    ./lrctl salesforceauditbeat config edit