Salesforce to Sentinel Integration

[mikhailf]

Hello Tech community,

With one of our customers, we are working on an integration of Salesforce with Sentinel and everything seems to work well but there are a few doubts. 

Has anyone worked on such integration? Is it worth ingesting Salesforce logs into Sentinel (asking because currently, we see only Login and Logout logs)?

Do you know if we need to configure anything on Salesforce or Sentinel (Azure) side to get more logs?

[#2]

Have you seen the Salesforce Service Cloud solution in the Content Hub? Not sure if your Salesforce is on-prem or in the cloud.

[#3]

Hello GBushey,
Yes, we have. This is the connector we are using.

[#4]

For those who will be looking for information about Salesforce logs in the future.
Login, Logout, and API usage logs are seen for the following Salesforce licenses: Enterprise, Unlimited, and Performance Edition.
Additional 50 types of logs can be gathered with Developer license.
If you don't want to change the license, Shield Event Monitoring feature should be purchased.

https://trailhead.salesforce.com/content/learn/modules/event_monitoring/event_monitoring_intro