> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources/salesforce/ingest-and-run-salesforce-automation-and-remediation.md).

# Salesforce connector

Cortex Data Security provides three primary methods for connecting to your Salesforce instance. Your choice depends on whether you need to ingest security event logs for monitoring, use the guided wizard setup for integrated services, or deploy specific legacy content packs for niche workflows.

### Product availability and licensing

This connector includes the following capabilities and sub-capabilities (if applicable), which are dependent on your licensing:

* **Data Security**: Requires the Data Security product license as well as the Cloud Posture Security or Cloud Runtime Security product license to view data risks in Cortex Cloud.
* **Identity Posture**: Requires the Data Security product license as well as the Cloud Posture Security or Cloud Runtime Security product license to view identity risks in Cortex Cloud.

Cortex Data Security can ingest identity metadata, login history, audit trails, and security monitoring events from Salesforce via capabilities to help you secure user identities, monitor for real-time threats, and automate issue response. To simplify setup, a wizard enables you to select specific capabilities based on your operational needs. The wizard then automatically identifies and provisions the underlying integrations required to support these capabilities.

The following table outlines the capabilities currently available in the wizard and the integrations it uses for each.

<table><thead><tr><th width="163">Capability</th><th width="165">Functionality</th><th width="245">Use Cases</th><th>Underlying Integrations Used</th></tr></thead><tbody><tr><td>Data Security</td><td>Scan and protect Salesforce data including files, attachments, and records.</td><td><ul><li>Sensitive data discovery: Identify PII, PCI, or PHI stored in Salesforce objects or Chatter messages to ensure compliance.</li><li>Malware prevention: Scan file uploads and attachments in real time to prevent malicious content from spreading within the CRM.</li><li>Exposure monitoring: Detect and alert on data shared with external collaborators or inadvertently made public.</li></ul></td><td>N/A</td></tr><tr><td>Identity Posture</td><td>Maintain visibility and control over SaaS-based identities, including users, groups, roles, and granular permissions.</td><td><p>• Overprivileged account detection: Identify and remediate users with administrative or "View All Data" permissions that exceed their job requirements.</p><p>• Dormant account cleanup: Surface inactive or stale user accounts to reduce the attack surface and optimize licensing costs.</p><p>• Local account investigation: Detect accounts created directly in Salesforce rather than through the organization's sanctioned Identity Provider (IdP).</p><p>• MFA compliance: Monitor for human or non-human identities accessing Salesforce without strong multi-factor authentication.</p></td><td>N/A</td></tr></tbody></table>

{% hint style="info" %}
**Prerequisite**

Cortex Data Security

* RBAC permissions: Requires **View/Edit** permissions for **Log Collections**, **Data Sources**, and **Integrations** (under **Configurations & Data Collections**).
* Content packs: Ensure the Salesforce and Base content packs are installed or updated to the latest version.
* Gateway permissions: Requires Account Admin or Instance Administrator permissions for configuring egress settings in the Cortex Gateway to allow communication with your Salesforce Domain URL.
  {% endhint %}

### How to configure the Salesforce connector

Perform the following procedures in the order that they appear, below.

#### Task 1. Configure the Salesforce External Client App

Salesforce is deprecating "Connected Apps"; it is recommended to use an External Client App.

1. In Salesforce, on the Setup page, search for App Manager and click New External Client App.
2. Provide a name (such as `panw_cortex_integration`), and your email address (used to retrieve the Consumer Key and Consumer Secret).
3. Under API (enable OAuth settings), select Enable OAuth.
4. Enter the following Callback URLs on separate lines (replacing `{tenant external URL}` with your tenant name):
   * `https://login.salesforce.com/services/oauth2/callback`
   * `https://{tenant external URL}.paloaltonetworks.com/configuration/data-sources`
5. Select these OAuth Scopes:
   * `Access and manage your Chatter data (chatter_api)`
   * `Manage user data via APIs (api)`
   * `Perform requests at any time (refresh_token, offline_access)`
6. Enable only these checkboxes after OAuth Scopes: Require Secret for Web Server Flow, Require Secret for Refresh Token Flow, and Enable Client Credentials Flow. For more information, see [Salesforce Client Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_client_credentials_flow.htm\&type=5).
7. Click Save, then Continue.

#### Task 2. Retrieve credentials

Consumer Key will be used for `client_id`, and Consumer Secret will be used for `client_secret` in OAuth 2.0.

1. On the Setup page, search for External Client App Manager.
2. Find your application (the one that you defined for Cortex Data Security), click the arrow button in the last column, and select Edit Settings.
3. In the OAuth Settings area, click Consumer Key and Secret.
4. Go back to the Salesforce Verify Your Identity page, paste the code received via email in the `Verification Code` box, and click Verify. One of the following will happen:
   * The Consumer Key and Consumer Secret will be sent to the email address that you configured earlier for the Cortex Data Security External Client App.
   * On the Salesforce External Client App Name page, the Consumer Details area will display the Consumer Key and Consumer Secret, and you will be able to copy them from here when required in the following procedures.

#### Task 3. Configure the refresh token expiration policy

1. On the Setup page, search for External Client App Manager.
2. Find your application (the one that you defined for Cortex Data Security), click the arrow button in the last column, and select Edit Policies.
3. In the OAuth Policies area:
   * Under Plugin Policies - Permitted Users, select All users can self-authorize.
   * Set the refresh token policy to Expire refresh token if not used for specific time (recommended). For example, select this option and set it for 7 days.

#### Task 4. Configure OAuth 2.0

Configure the OAuth 2.0 application to call the Salesforce.com API with one of the following flows:

* Client credentials flow: For more information, see [Configure an External Client App OAuth 2.0 Client Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_client_credentials_flow.htm\&type=5).
* Web server flow: For more information, see [OAuth 2.0 Web Server Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm\&language=en_US\&type=5).

#### Task 5. Configure egress in Cortex Gateway

An Account Admin or Instance Administrator must configure egress settings in the Cortex Gateway to allow communication with your Salesforce Domain URL. For more information, see [Egress Configurations](/gateway-guide/egress-configurations.md).

1. Log in to the Cortex Gateway with Account Admin or Instance Administrator permissions and click Permission Management.
2. From the side menu, select Egress Configurations.
3. In the TENANT dropdown, select the tenant where you are configuring the Salesforce integration.
4. Click +Path to initiate a new path request.
5. In the New Path dialog box, configure the following:
   * Requester: In the dropdown, select the requester from the list of users.
   * Flow: In the dropdown, select the appropriate data service option for a generic webhook/host out (or Salesforce if it is explicitly listed).
   * Path: Enter the domain name or host of your Salesforce instance (for example, your-company.my.salesforce.com).

     <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>Do not include https:// or trailing slashes.</p></div>
6. Click Add to create the path. Once the status of the path shows as Approved in the Egress Configuration table, Cortex Data Security can successfully authenticate and execute commands against your Salesforce environment.

#### Task 6. Configure Cortex Data Security

1. In Cortex Data Security, navigate to **Settings** → **Data Sources & Integrations**.
2. Click **+ Add new**.
3. In the **Add Data Source** page, search for Salesforce.
4. Under **Recommended**, hover over the new Salesforce integration and click **Add Instance** to launch the Salesforce wizard.\
   The new Salesforce connector has the description: Salesforce CRM services for identity management, automation, remediation and SaaS Posture Security.
5. Set up your Salesforce instance by following the wizard steps in the following tabs.

**Capabilities tab**

Configure the following.

1. Instance name: Enter a unique name for your instance.
2. Select capabilities: Choose the required instance functionality:
   * Data Security: Scan and protect Salesforce data including files, attachments, and records. \\

     <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>To select this capability, you must first select the Identity Posture capability.</p></div>
   * Identity Posture: Maintain visibility and control over SaaS-based identities, including users, groups, roles, and granular permissions.
3. Click Next.

**Connection tab**

Enter credentials to securely authorize the connection.

1. **Domain URL**: Copy the URL from your browser's address bar while logged into Salesforce and paste it into this field. This must be identical to the domain URL defined in the Cortex Gateway egress configuration in the **Path** field as explained in Task 5. If you did not configure egress in Cortex Gateway, you will get an error during verification. You can continue with instance configuration without verifying and set up egress at a later point.
2. Click **Apply**.

{% hint style="warning" %}

### **Important**

You cannot proceed with the authentication configuration until you provide a domain URL and click **Apply**.When you click **Apply**, the instance is connected to a unique URL in Salesforce, and it cannot be changed. To change it, you need to exit the wizard and start over.
{% endhint %}

3. Select **Recommended** or **Advanced**.
   * **Recommended** applies he suggested authentication method for all capabilities.
   * **Advanced** enables configuring unique credentials for each capability individually.
4. Authenticate using the **OAuth 2.0 Web Server Flow** or **OAuth 2.0 Client Credentials**.
   * For more information about the web server flow, see [OAuth 2.0 Web Server Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm\&language=en_US\&type=5).
   * For more information about the client credentials flow, see [Configure an External Client App OAuth 2.0 Client Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_client_credentials_flow.htm\&type=5).
5. Click **Done** for each authentication method.

**Configuration tab**

Configure the following.

* **Under Security Posture:**
  * **Sync Interval**: Defines how often the system checks your cloud environment for security risks, misconfigurations, and compliance updates. More frequent syncs may impact API rate limits. The default is every 15 minutes.
  * **Application Tag**: Assigns a category to your cloud resources based on their operational purpose. This helps you filter security alerts and apply different compliance policies to specific environments. The default is None.

**Summary tab**

A confirmation is displayed that your Salesforce instance is successfully connected and a real-time status of the security capabilities activated (if relevant).

Once you confirm the summary details, click **Create instance**.

#### **Task 7. (Optional) Edit or test existing Salesforce instance settings**

You can edit and test an existing instance after a successful initial connection between Salesforce and Cortex Data Security. Do this by clicking **Test**.

{% hint style="warning" %}
**Important**

If a “connected application” for Cortex Data Security data collection already exists, you are not required to migrate to an “External Client App”, but since Connected Applications are deprecated by Salesforce, it is recommended to migrate.
{% endhint %}

#### **Task 8. (Optional) Post verification**

After onboarding is complete, verify asset discovery and data security findings.

**1. Verify discovered assets**

1. Go to **Inventory** > **All Assets**.
2. Filter the asset list by setting **Provider** to **Salesforce**.
3. If applicable, filter by the relevant **Category**.
4. Verify that Cortex discovers the following supported Salesforce asset types:
   * **Salesforce User Storage:** Files, including PDFs, images, and documents, uploaded by users across the Salesforce environment.
   * **Knowledge Base:** Knowledge base articles created within the Salesforce environment.
   * **Chatter Messages:** Text messages, posts, and comments created in user Chatter feeds and groups.

**2. Verify policy findings**

1. Select an asset to open the details panel.
2. Click the **Overview** tab to review general properties and total finding counts.
3. Click **Findings** to review detected security findings, such as:
   * Social Security numbers (SSNs)
   * API keys or secrets
   * Credit card numbers
   * Other sensitive personally identifiable information (PII)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources/salesforce/ingest-and-run-salesforce-automation-and-remediation.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.