> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-logs-and-data-from-salesforce.com.md). # Ingest logs and data from Salesforce.com {% hint style="info" %} ### Notice Ingestion of logs and data requires a Cortex XDR Pro per GB license. {% endhint %} {% hint style="info" %} ### Note This data source is only available in your tenant if the tenant was activated before October 1, 2025 with an active Cortex XDR Pro per GB license. {% endhint %} The Cortex XDR data collector can collect Audit Trail and Security Monitoring event logs from Salesforce.com. During setup of this data collector, you can choose to accept the default collection settings, or exclude the collection of content metadata and accounts. The Salesforce.com data collector fetches events, and objects and metadata, including: * Login history * Setup audit trail * Flow Execution events * Transaction Security events * Content Distribution events * Package Install events You can create multiple Salesforce.com data collector instances in Cortex XDR, for different parts of your organization. Logs are collected from Salesforce.com every 30 seconds. When Cortex XDR begins receiving logs, it creates new datasets for them, called `salesforce__raw`. Examples of `` include: * connectedapplication * permissionset * profile * groupmember * group * user * userrole * document * contentfolder * attachment * contentdistribution * tenantsecuritylogin * useraccountteammember * tenantsecurityuserperm * account * audit * login * eventlogfile You can use these datasets to perform XQL search queries. For example queries, refer to the in-app XQL Library. {% hint style="warning" %} ### Prerequisite * Cortex XDR: * To manage collection integration in Cortex XDR, ensure that you have the privilege to View/Edit Log Collections (for example, Instance Administrator). * Salesforce.com: * The minimum required Salesforce.com editions are Professional Edition with API access enabled, or Enterprise Edition, or higher. * Ensure that your organization has a Salesforce Shield license. For more information, refer to:

Note

Ensure that you have the required licenses. If these prerequisites are not met, fetching of security data and event data will be severely limited, and errors will be generated.

* To use the client credentials flow required for Salesforce.com–Cortex XDR integration, you must create a connected app for Cortex XDR in Salesforce.com, and configure its OAuth settings and access policies, as described in this procedure. The connected app must be created by a Full System Admin. * In **Setup**, **Event Monitoring Settings**, ensure that **Generate event log files** is enabled. * In **Setup**, verify that there are event log files in the **Event Log File Browser**. * In **Setup**, **Permission Sets**, verify that there is a permission set called **Event Monitoring**. {% endhint %} {% hint style="info" %} ### Note For more detailed reference information, see [Configure a Connected App for the OAuth 2.0 Client Credentials Flow](https://help.salesforce.com/s/articleView?id=sf.connected_app_client_credentials_setup.htm\&type=5). Unlike other data collector setups, in this case, the setup includes obtaining an OAuth 2.0 code from Salesforce.com, and this code is only valid for 15 minutes. Therefore, make sure that you enable the data collector within 15 minutes of obtaining the authorization code. {% endhint %} Perform the following procedures in the order that they appear, below.
Task 1. Configure Salesforce Connected App 1. On the **Setup** page, in **Quick Find**, type `App Manager`. 2. Click **New Connected App**. 3. Enter a meaningful name for the connected application and for the API. For example, you could name it panw\_cortex\_integration. 4. Enter your email address. This address will be used to retrieve the Consumer Key and Consumer Secret. 5. Select the **Enable OAuth Settings** checkbox. 6. In **Callback URL**, type `https://login.salesforce.com/services/oauth2/callback` and `https://{tenant external URL}.paloaltonetworks.com/configuration/integrations` on separate lines, where `{tenant external URL}` is the name of your tenant as it appears in the URL of your Cortex XDR tenant. 7. For **OAuth Scopes**, select **Full access (full)** and **Perform requests at any time (refresh\_token, offline\_access)**. 8. In the next options after **OAuth Scopes**, ensure that only the following checkboxes are selected: * **Require Secret for Web Server Flow** * **Require Secret for Refresh Token Flow** * **Enable Credentials Flow** 9. Click **Save**, and then **Continue**.
Task 2. Retrieve the Consumer Key and Consumer Secret Consumer Key will be used for client\_id, and Consumer Secret will be used for client\_secret in OAuth 2.0. 1. On the **Setup** page, in **Quick Find**, type `App Manager`. 2. Find your connected application (the one that you defined for Cortex XDR). In the last column, click the arrow button and then click **View**. 3. In the **API (Enable OAuth Settings)** area, click **Manage Consumer Details**. 4. When you are asked to verify your identity, open the email that Salesforce sent to you, and copy the verification code. Go back to the Salesforce **Verify Your Identity** page, paste the code in the **Verification Code** box, and click **Verify**. One of the following will happen: * The Consumer Key and Consumer Secret will be sent to the email address that you configured earlier for the Cortex XDR connected app. * On the Salesforce **Connected App Name** page, the **Consumer Details** area will display the **Consumer Key** and **Consumer Secret**, and you will be able to copy them from here when required in the following procedures.
Task 3. Configure the Refresh Token expiration policy 1. On the **Setup** page, in **Quick Find**, type `App Manager`. 2. Find your connected application (the one that you defined for Cortex XDR). In the last column, click the arrow button and then click **Manage**. 3. Click **Edit Policies**. 4. In the **OAuth Policies** area: * Under **Permitted Users**, select **All users may self-authorize**. * Choose your refresh token policy. We recommend: **Expire refresh token if not used for \_ Day(s)**. For example, select this option and set it for 7 days.
Task 4. Configure OAuth 2.0 * Configure the OAuth 2.0 application to call the Salesforce.com API using client\_id and client\_secret. References:
Task 5. Configure Cortex XDR 1. In Cortex XDR, create a Salesforce.com data collector instance: * Select **Settings** → **Configurations** → **Data Collection** → **Collection Integrations**. * In the **Salesforce.com** configuration, click **Add Instance**. 2. Enter a unique **Name** for the instance, enter the **Salesforce Domain Name**, and the **Consumer Key** and the **Consumer Secret** credentials obtained earlier in this workflow. For example, the domain could be the API URL from which logs are received, such as `https://MyDomainName.my.salesforce.com/services/data/vXX.X/resource/` 3. (Optional) Clear options that you do not require: * **Content metadata**: when selected (default), collects documents’ metadata. * **Accounts**: when selected (default), collects account objects.

Note

When these options are cleared, only these data types will be omitted from collection. All other data will be collected as usual.

4. Click **Enable**. A popup which redirects you to your Salesforce instance appears, to get OAuth 2.0 authorization credentials and access. 5. Click **OK**. In Salesforce.com, a new tab appears. 6. Enter your **username** and **password**, and **Log In**. 7. When you are asked to allow access, select **Allow**. A Salesforce data collection instance is created, and an authorization token is created and returned to Cortex XDR. Data collection begins.
Task 6. (Optional) Edit or test existing Salesforce.com collector settings You can edit and test an existing collector instance after a successful initial connection between Salesforce.com and Cortex XDR. Do this by clicking **Edit** (pencil icon) for the collector instance. The log collection window will be displayed, where you can make changes or test, by clicking **Test**.
**Troubleshooting** If for any reason, the token is not created and sent to Cortex XDR, after a timeout period, an authorization failure error will be returned for the collector instance. In this case, try again by clicking **Edit** (pencil icon) for the collector instance. The log collection window will be displayed again, where you can edit settings and retry getting the authorization code. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-logs-and-data-from-salesforce.com.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.