Salesforce

Configure Salesforce data sources for Cortex XDR.

Here are the articles in this section:

• Ingest logs and data from Salesforce

• Salesforce connector

You can configure collecting Salesforce logs and data using a standard collector, content pack integration (onboarded prior to July 26, 2026), or connector:

Salesforce instance configuration method	Description
Standard Collector	Ingests Audit Trail and Security Monitoring event logs, including: Login history Setup audit trail Flow Execution events Transaction Security events Content Distribution events Package Install events
Link to standard collector	Ingest logs and data from Salesforce
Link to connector	Salesforce connector: Uses the Salesforce content pack to provide full CRM services for data security, automation and remediation, security posture, and identity posture. Includes the following integrations: Salesforce IAM: Performs Identity Lifecycle Management operations. Salesforce: Provides CRM services.