Realm.Security Documentation

Appearance

Salesforce Event Monitoring Integration ​


Salesforce Event Monitoring Architecture

Send Salesforce Event Monitoring Logs to Realm ​

This guide walks you through connecting Salesforce Event Monitoring to Realm. The integration uses a polling-based approach — Realm Cloud periodically queries the Salesforce API to retrieve event log files, then forwards them through your data pipeline to your configured destination.

Realm supports the following Salesforce Event Monitoring log types:

  • Login — user login history
  • LoginAs — admin actions performed while logged in as another user
  • Logout — user logout events
  • URI — user interactions with the web browser UI

Prerequisites ​

  • An active Salesforce account with administrator access
  • Event Monitoring enabled for your Salesforce org (an additional Salesforce license may be required)
  • Access to the Realm Security console

Enable Event Monitoring ​

Before setting up the integration, you must enable Event Monitoring in your Salesforce org.

  1. Log in to Salesforce as an administrator.

  2. Click the gear icon in the top-right corner and select Setup.

  3. Click Open Advanced Setup.

    Open Advanced Setup

  4. In the search box, enter Event Monitoring and click Event Monitoring Settings.

    Event Monitoring Settings

  5. Enable the Generate event log files toggle to start collecting event log files.

    Enable Event Log File Generation

Create an External Client App in Salesforce ​

Realm authenticates to the Salesforce API using an External Client App configured with the Client Credentials flow. Follow the steps below to create the app and collect the credentials needed by Realm.

  1. Log in to Salesforce as an administrator.

  2. Click the gear icon in the top-right corner and select Setup.

  3. In the Quick Find box, search for External Client Apps and select External Client App Manager.

  4. Click New External Client App.

  5. Fill in the required fields:

    External Client App Name: Realm Event Monitoring
    API Name: Realm_Event_Monitoring
    Contact Email: <your admin email>

  6. Under OAuth Settings, enable Enable OAuth Settings.

  7. Set the Callback URL to https://login.salesforce.com/services/oauth2/callback (a placeholder is required by Salesforce; Realm uses client credentials and does not use a callback URL).

  8. Under Selected OAuth Scopes, add the following scopes:

    • Manage user data via APIs (api)
    • Perform requests at any time (refresh_token, offline_access)

  9. Enable Enable Client Credentials Flow.

  10. Click Save.

Important: After saving, Salesforce will display the Consumer Key (Client ID) and Consumer Secret (Client Secret). Copy and save both values immediately — the Consumer Secret may not be shown again. You will need both values when configuring the integration in Realm.

  1. Note your Salesforce domain. This is the base URL visible in your browser address bar when logged in to Salesforce (for example, https://mycompany.my.salesforce.com).

Assign Permissions to the External Client App ​

The External Client App must be granted the permissions required to read Event Log Files.

  1. In Setup, search for Permission Sets in the Quick Find box and click Permission Sets.

  2. Click New to create a new permission set.

  3. Enter a label and API name:

    Label: Realm Event Monitoring
    API Name: Realm_Event_Monitoring

  4. Click Save.

  5. On the new permission set's page, click System Permissions.

  6. Click Edit, then enable the following permissions:

    • API Enabled
    • View Event Log Files

  7. Click Save.

  8. Return to External Client App Manager, open the Realm Event Monitoring app, and navigate to Manage > Edit Policies.

  9. Under Client Credentials Flow, set Run As to a system user that has the Realm Event Monitoring permission set assigned. This user must have API access and the ability to view event log files.

  10. Click Save.

Configure the Integration in Realm ​

  1. Create a new Source.

    Name: Salesforce Event Monitoring
    Format: Salesforce Event Monitoring

  2. Add a new Input feed.

    Type: Salesforce Event Monitoring
    Salesforce Domain: <your Salesforce domain, e.g. https://mycompany.my.salesforce.com>
    Client ID: <your Consumer Key>
    Client Secret: <your Consumer Secret>

  3. Select the event types you want Realm to collect:

    • Login
    • LoginAs
    • Logout
    • URI

  4. Click Save.

Once saved, the Realm poller will begin retrieving Salesforce Event Monitoring log files at regular intervals and forward them through your data pipeline to your configured destination.

Note: For more details on Salesforce Event Monitoring and available event types, refer to the Salesforce Event Monitoring documentation.