We are already ingesting Salesforce data via the Salesforce for Splunk Add on.
I have a requirement to monitor when an admin permission set has been assigned to a user and what changes that user makes.
Has anyone fulfilled a similar requirement?
So far i have found a list of the following objects that could provide the information i need to see when a permission set is assigned to a user (https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_...) but not sure how to track what changes that admin user makes.
Can you help?
