Salesforce integration with Splunk

[mohsplunking]

Hello Splunkers,

I have a question around integration of Salesforce with Splunk , I see there are two Add-on available on Splunkbase one is supported by Splunk and the other seems to be from Salesforce, However, my concern is what is the difference between the two and which one seems to be working well inline with the Security use-cases.  Appreciate if you guyz can share your experience with Salesforce integration.

Thanks,

regards,

Moh.

[tscroggins]

Hi @mohsplunking,

Splunk Add-on for Salesforce pulls objects from the Salesforce Query API with Salesforce Object Query Language (SOQL) using object-specific Date/Time fields as checkpoints.

See https://splunk.github.io/splunk-add-on-for-salesforce/Install/ for installation instructions.

Basic source type, object, and data model details are documented at https://splunk.github.io/splunk-add-on-for-salesforce/SourceTypes/ and https://splunk.github.io/splunk-add-on-for-salesforce/Configureinputsv1modular/, respectively.

Here's a more detailed mapping:

Source Type           Object           Checkpoint         CIM Data Model
-----------           ------           ----------         --------------
sfdc:account          Account          LastModifiedDate
sfdc:contentversion   ContentVersion   LastModifiedDate
sfdc:dashboard        Dashboard        LastModifiedDate
sfdc:logfile          EventLogFiles    CreatedDate        Authentication
                                                          Change
                                                          Web
sfdc:loginhistory     LoginHistory     LoginTime          Authentication
sfdc:object           (Any)            LastModifiedDate
sfdc:opportunity      Opportunity      LastModifiedDate
sfdc:report           Report           LastModifiedDate
sfdc:user             User             LastModifiedDate

If a predefined input does not meet your requirements, you can create a custom input for any object.

Splunk Add-on for Salesforce Streaming API uses a pub/sub model to receive real-time event monitoring objects using real-time Event Monitoring.

Note the differences in supported authentication types on the Splunkbase Details tab. Select either version 1.1.1 or 2.0.0 or later based on your requirements.

Here's a mapping of source types, tested (presumably) objects, and data models:

Source Type                          Object                    CIM Data Model
-----------                          ------                    --------------
sfdc-streaming-api-events:login      LoginEventStream          Authentication
                                     LogoutEventStream
                                     LoginAsEventStream
sfdc-streaming-api-events:report     ReportEventStream         Data Access
sfdc-streaming-api-events:security   ApiAnomalyEvent           Intrusion Detection
                                     CredentialStuffingEvent
                                     SessionHijackingEvent

See $SPLUNK_HOME/etc/apps/TA-sfdc-streaming-api/default/props.conf for the fields expected by each source type. You may be able to stream additional objects. For example, ApiEventStream and UriEventStream contain a subset of the fields expected by the sfdc-streaming-api-events:report source type; however, you may prefer to create custom source types, e.g., sfdc-streaming-api-events:api and sfdc-streaming-api-events:uri, with their own field extractions, event types, and tags for data model support.

Splunk publishes Enterprise Security content in Splunk ES Content Update (ESCU)  and at https://research.splunk.com/. If you don't use Enterprise Security, you can adapt the searches to your use cases or use them as a general reference.

Whether to use Splunk Add-on for Salesforce, Splunk Add-on for Salesforce Streaming API, or both depends on your use cases. If you have a specific deployment architecture and security use case in mind, we can map the relevant Salesforce content to an add-on and configuration.