Collect Salesforce logs

Overview

This parser handles Salesforce logs in LEEF, CSV, and JSON formats. It extracts fields, performs format-specific processing (handling LEEF key-value pairs, CSV columns, and JSON structures), maps them to the UDM, and enriches the data with metadata and derived fields. The parser also handles various Salesforce event types, applying specific logic for logins, logouts, and other actions, categorizing events, and setting appropriate UDM event types.

Before you begin

• Ensure that you have a Google SecOps instance.
• Ensure that you have privileged access to AWS IAM, S3 and AppFlow.

Configure Amazon S3 bucket

1. Create an Amazon S3 bucket following this user guide: Creating a bucket
2. Save the bucket Name and Region for future reference.
3. Create a User following this user guide: Creating an IAM user.
4. Select the created User.
5. Select Security credentials tab.
6. Click Create Access Key in the Access Keys section.
7. Select Third-party service as the Use case.
8. Click Next.
9. Optional: Add a description tag.
10. Click Create access key.
11. Click Download .csv file. (Save Access Key and Secret Access Key for future reference).
12. Click Done.
13. Select the Permissions tab.
14. Click Add permissions in the Permissions policies section.
15. Select Add permissions.
16. Select Attach policies directly.
17. Search for the AmazonS3FullAccess policy.
18. Select the policy.
19. Click Next.
20. Click Add permissions.

Configure Amazon AppFlow

1. Create an Amazon AppFlow flow:
   • Flow name: Add a flow name and click Next.
   • Data source: Choose Salesforce as the data source.
   • Create a new connection.
   • A Salesforce sign-in window appears. Sign in with your Salesforce credentials.
   • Select the object name (choose the data you want to transfer from Salesforce to the S3 bucket).
   • Select Amazon S3 as the data destination.
   • Select Schedule as the flow trigger.
   • In Choose Source Fields, you can either Map all fields directly or you can specify which fields to map.
2. Validate the configuration:
   • In Amazon AppFlow, select the flow you created, and click Run flow to fetch data from Salesforce.
   • The logs should now be in your S3 bucket.

Configure a feed in Google SecOps to ingest Salesforce logs

1. Go to SIEM Settings > Feeds.
2. Click Add new.
3. In the Feed name field, enter a name for the feed (for example, Salesforce Logs).
4. Select Amazon S3 as the Source type.
5. Select Salesforce as the Log type.
6. Click Next.

7. Specify values for the following input parameters:

   • Region: the region where the Amazon S3 bucket is located.
   • S3 URI: the bucket URI. s3:/BUCKET_NAME Replace the following:
     • BUCKET_NAME: the name of the bucket.
   • URI is a: select URI TYPE according to S3 stream configuration: Single file | Directory | Directory which includes subdirectories.
   • Source deletion options: select deletion option according to your preference.
   • Access Key ID: the User access key with access to the s3 bucket.
   • Secret Access Key: the User secret key with access to the s3 bucket.
   • Asset namespace: the asset namespace.
   • Ingestion labels: the label to be applied to the events from this feed.

8. Click Next.

9. Review your new feed configuration in the Finalize screen, and then click Submit.

UDM Mapping Table

Changes

2024-06-04

• Added support for newly ingested logs.

2024-03-06

• Changed mapping of the field "Id" from "metadata.product_log_id" to "principal.user.userid".
• Changed mapping of the field "CreatedById" from "principal.user.userid" to "principal.resource.attribute.labels".
• Mapped "IsDeleted" to "principal.resource.attribute.labels".
• Mapped "LogFileLength" to "principal.resource.attribute.labels".
• Mapped "LogFileContentType" to "principal.resource.attribute.labels".
• Mapped "ApiVersion" to "principal.resource.attribute.labels".
• Mapped "LogFile" to "principal.resource.attribute.labels".

2023-02-24

• Enhancement-
• "security_result.action" mapped to ALLOW instead of BLOCK if the action is "LOGIN_NO_ERROR".
• For "Login" events :
• "action" mapped to "security_result.action".
• "target_user_name" mapped to "target.user.userid".
• "tls_protocol" mapped to "network.tls.version_protocol".
• "cipher_suite" mapped to "network.tls.cipher".
• Added "on_error" check for "OsVersion" and "date" block.

2022-12-13

• Enhancement-
• Mapped "LoginType" to "security_result.description".
• Mapped "LoginUrl" to "principal.url".
• Added empty check for "ApiType" and "LoginGeo.City".

2022-09-02

• Enhancement-
• Migrated the custom parsers into default parser.

2022-07-04

• Enhancement-
• Enhanced the parser to parse the logs having event_type 'LoginHistory'.
• Added condition to parse different formats of timestamp.
• Added condition for event_type 'USER_UNCATEGORIZED' where 'user_id' or 'UserId' or 'target_user_name' is not null.
• Added validation for parsing src_ip.

2022-04-18

• Enhancement-Modified mapping for DOWNLOAD_FORMAT from 'metadata.ingestion_labels' to 'target.resource.attribute.labels'.

2022-03-30

• Enhancement-Changed event_type for 'LoginEventStream' to USER_LOGIN.
• Corrected mapping for the fields DOWNLOAD_FORMAT and ConnectedAppId.
• Added mappings for certain fields when log is of type LoginEventStream, WaveDownload, ApiEventStream.