Hello everyone,
I am currently supporting an integration between Salesforce and a SIEM platform (IBM QRadar). The goal is to monitor audit-related events such as:
- User login activity
- API usage
- General user activity
- Security-related events
We have reviewed some IBM-documented approaches, including:
- Salesforce Security Monitoring Server
- CSV export of audit logs
However, these options do not seem optimal, especially due to the lack of real-time monitoring capabilities.
From the Salesforce side, my role is mainly to enable access (APIs, configurations, etc.), while the security team is responsible for the SIEM integration.
I would like to ask the community:
- What is the simplest and most recommended way to expose audit events from Salesforce to a SIEM?
- Is using the EventLogFile object via REST API sufficient, or would you recommend using Streaming API / Pub-Sub API?
- Is it mandatory to have Event Monitoring (Shield) licenses for a basic monitoring use case?
- Have you implemented similar integrations with QRadar or other SIEM tools? What approach worked best for you?
The goal is to find the simplest possible solution from the Salesforce side, avoiding overly complex architectures unless strictly necessary.
I appreciate any guidance or recommendations.
Thank you.
#Trailhead Challenges #Admin #Salesforce Developer
-
1. Simplest recommended approach
Start with EventLogFile via REST API. It’s easy to expose and works fine if near real-time (not instant) is acceptable.
2. Real-time vs near real-time
- EventLogFile = delayed (few minutes to hours)
- Streaming API / Pub-Sub API = near real-time If your SIEM needs live alerts, go with Streaming or Pub-Sub API.
3. Shield (Event Monitoring license)
- Yes, for detailed logs (API usage, login events, etc.)
- Without it, you only get very limited data
4. What works best in real projects
- Basic setup: EventLogFile + scheduled pull
- Better setup: Real-Time Event Monitoring (Streaming API) for critical events
