Salesforce Security Auditing

The JSA DSM for Salesforce Security Auditing can collect Salesforce Security Auditing audit trail logs that you copy from the cloud to a location that JSA can access.

The following table identifies the specifications for the Salesforce Security Auditing DSM:

Table 1: Salesforce Security Auditing DSM Specifications
Specification	Value
Manufacturer	Salesforce
DSM	Salesforce Security Auditing
RPM file name	DSM-SalesforceSecurityAuditing-`JSA_Version-Build_Number`.noarch.rpm
Protocol	Log File
JSA recorded events	Setup Audit Records
Automatically discovered	No
Includes identity	No
More information	Salesforce web site (http://www.salesforce.com/)

Salesforce Security Auditing DSM Integration Process

To integrate Salesforce Security Auditing DSM with JSA, use the following procedures:

If automatic updates are not enabled, download and install the most recent versions of the following RPMs from the Juniper Downloads onto your JSA Console:
- Log File Protocol RPM
- Salesforce Security Auditing RPM
Download the Salesforce audit trail file to a remote host that JSA can access.
For each instance of Salesforce Security Auditing, create a log source on the JSA Console.

Downloading the Salesforce Audit Trail File

To collect Salesforce Security Auditing events, you must download the Salesforce audit trail file to a remote host that JSA can access.

You must use this procedure each time that you want to import an updated set of audit data into JSA. When you download the audit trail file, you can overwrite the previous audit trail CSV file. When JSA retrieves data from the audit trail file, JSA processes only audit records that were not imported before.

Log in to your Salesforce Security Auditing server.
Go to the Setup section.
Click Security Controls.
Click View Setup Audit Trail.
Click Download setup audit trail for last six months (Excel.csv file).
Copy the downloaded file to a location that JSA can reach by using Log File Protocol.

Log File Log Source Parameters for Salesforce Security Auditing

If JSA does not automatically detect the log source, add a Salesforce Security Auditing log source on the JSA Console by using the Log File protocol.

When using the Log File protocol, there are specific parameters that you must use.

The following table describes the parameters that require specific values to collect Log File events from Salesforce Security Auditing:

Table 2: Log File log source parameters for the Salesforce Security Auditing DSM
Parameter	Value
Log Source type	Salesforce Security Auditing
Protocol Configuration	Log File
Event Generator	RegEx Based Multiline
Start Pattern	(\d{1,2}/\d{1,2}/\d{4} \d{1,2}:\d{2}:\d{2} \w+)
End Pattern	Ensure that this parameter remains empty.
Date Time RegEx	(\d{1,2}/\d{1,2}/\d{4} \d{1,2}:\d{2}:\d{2} \w+)
Date Time Format	dd/MM/yyyy hh:mm:ss z

ON THIS PAGE

Salesforce Security Auditing