SalesForce Real-Time Event Monitoring Connector (via Codeless Connector Framework)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Connectors Index

Attribute Value
Connector ID SalesForceRTEMConnector
Publisher Microsoft
Used in Solutions Salesforce Service Cloud
Collection Method CCF
Connector Definition Files SalesforceRealTimeEventMonitoring_DataConnectorDefinition.json
DCR Definition Files SalesforceRealTimeEventMonitoring_DCR.json
CCF Configuration SalesforceRealTimeEventMonitoring_PollingConfig.json
CCF Capabilities OAuth2, Paging
Microsoft Learn View on Learn

The Salesforce Real-Time Event Monitoring (RTEM) Connector provides the capability to ingest information about your Salesforce real time events using Object for Event Storage into Microsoft Sentinel through the REST API. The connector provides ability to review events in your org on an accelerated basis, get real-time event data for recent activity.

Tables Ingested

This connector ingests data into the following tables:

Table Transformations Ingestion API Lake-Only
SalesForceRealTimeEventMonitoring_CL ✗ ✓ ✗

💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.

Permissions

Resource Provider Permissions:

Custom Permissions:

Setup Instructions

⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.

1. Connect to Salesforce Event Monitoring to start collecting real-time event monitoring logs in Microsoft Sentinel

Follow Create a Connected App in Salesforce for OAuth and Configure a Connected App for the OAuth 2.0 Client Credentials Flow to create a Connected App with access to the Salesforce Event Monitoring API. Through those instructions, you should get the Consumer Key and Consumer Secret. For Salesforce Domain name, Go to Setup, type My Domain in the Quick Find box, and select My Domain to view your domain details. Make sure to enter the domain name without a trailing slash (e.g., https://your-domain.my.salesforce.com). Fill the form below with that information.

ℹ️ Required Add-on subscription: Your Salesforce account should include Salesforce Shield or Salesforce Event Monitoring add-on subscriptions for this connector to work. Connector Management Interface

This section is an interactive interface in the Microsoft Sentinel portal that allows you to manage your data collectors.

📊 View Existing Collectors: A management table displays all currently configured data collectors with the following information:

➕ Add New Collector: Click the "Add new collector" button to configure a new data collector (see configuration form below).

🔧 Manage Collectors: Use the actions menu to delete or modify existing collectors.

💡 Portal-Only Feature: This configuration interface is only available when viewing the connector in the Microsoft Sentinel portal. You cannot configure data collectors through this static documentation.

Configure API Connection

Connect to Salesforce to ingest data

When you click the "Add Connection" button in the portal, a configuration form will open. You'll need to provide:

Base Configuration

OAuth2 Client Credentials

💡 Portal-Only Feature: This configuration form is only available in the Microsoft Sentinel portal.

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Connectors Index