Device Configuration: Salesforce

TABLE OF CONTENTS

• Overview
• Prerequisites
• Salesforce API Credential Generation
  • Step 1: Create a Connected App in Salesforce
  • Step 2: Generate Authorization Code
  • Step 3: Exchange Authorization Code for Refresh Token
• Configure Salesforce in ADR SIEM
• Verification (MSSP Only)
  • On ADR CCE
  • On ADR SIEM UI

Overview

This guide explains how to integrate Salesforce with ADR SIEM (aiSIEM/aiXDR) using the Salesforce API. The process requires creating a Connected App, generating OAuth tokens, and configuring ADR with the API credentials. Logs are collected via the CCE (Collection and Control Engine) and analyzed in the APE (Analytics and Policy Engine) for proactive monitoring, anomaly detection, and compliance visibility.

Prerequisites

• Salesforce administrator access.

• ADR SIEM administrator access.

• ADR CCE server IP.

Salesforce API Credential Generation

Step 1: Create a Connected App in Salesforce

1. Log in to Salesforce as Admin.

2. Go to: Setup → App Manager.

3. Click New Connected App.

4. Fill in:

   • Connected App Name, API Name, Contact Email.

   • Under API (Enable OAuth Settings), check Enable OAuth Settings.

   • Callback URL → https://login.salesforce.com/ (or another valid URL).

   • OAuth Scopes → Select required scopes (recommended: Full Access, API, Refresh Token).

5. Save. Salesforce may take a few minutes to propagate changes.

6. Navigate to Manage Consumer Details → copy the Consumer Key and Consumer Secret.

Step 2: Generate Authorization Code

1. Copy this URL and replace <Consumer Key> and <Callback URL> with your values:

https://login.salesforce.com/services/oauth2/authorize?response_type=code&client_id=<Consumer Key>&redirect_uri=<Callback URL>

2. Paste it into a browser → log in with Salesforce credentials.

3. Click Allow to authorize.

4. You will be redirected to the callback URL, e.g.:

https://login.salesforce.com/?code=<authorization_code>

Note the authorization_code in the URL. (You may need to URL-decode it.)

Step 3: Exchange Authorization Code for Refresh Token

Use Postman (or curl) to generate a refresh token:

• Method: POST

• URL:

https://login.salesforce.com/services/oauth2/token

• Body (x-www-form-urlencoded):

grant_type=authorization_code
client_id=<Consumer Key>
client_secret=<Consumer Secret>
code=<Authorization Code>
redirect_uri=<Callback URL>

The response will contain a refresh_token.

Configure Salesforce in ADR SIEM

1. Log in to ADR SIEM UI with admin rights.

2. Navigate to: Administration → Add-on Store 

3. Search for Salesforce → Add.

4. Fill in the fields:

{"refresh_token": "<refresh_token>", "domain_name": "<domain_name>"}

Replace v57.0 with your current Salesforce API version.

4. Save the configuration.

Verification (MSSP Only)

On ADR CCE

Run:

otmdoc -s addondevices
crontab -l

• Confirm that the Salesforce add-on script is scheduled.

On ADR SIEM UI

1. Navigate: System → Logs and Flows Collection Status.

2. Verify that Salesforce appears under Source Device IP.

3. Confirm that logs are parsed correctly.