> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/integrations/salesforce.md).
# Salesforce
As a mission-critical cloud application with over 150,000 customers, Salesforce implementations are often customized and complex, and don't necessarily address potential security issues.
{% hint style="success" %}
Salesforce Event Monitoring is a DoControl Premium module. To enable it, please contact Customer Success.
{% endhint %}
## Use cases
Integrating DoControl with Salesforce enables you to detect and prevent unnecessary exposure and address these use cases:
* **Get real-time event notifications -** DoControl's Premium event monitoring capabilities allow you to receive real-time events based on the Salesforce Event Monitoring add-on, and take action via DoControl workflows.
* **Remediate future data exposure** - Leverage automated workflows to prevent future exposure in Salesforce, such as:
* Detect login from disabled accounts
* Detect suspicious login attempts
* Notify on suspicious API queries in Salesforce
* Notify on bulk actions in Salesforce
* Notify when sensitive reports are exported by terminated employees
## Integrate Salesforce
To integrate Salesforce with DoControl, you need to complete these procedures in order:
1. [Set up permissions in Salesforce](#set-up-permissions-in-salesforce)
2. [Enable event monitoring in Salesforce](#enable-event-monitoring-in-salesforce) (Premium)
3. [Integrate Salesforce with DoControl](#integrate-salesforce-with-docontrol)
4. [Configure OAuth scope settings](#configure-oauth-scope-settings)
## Set up permissions in Salesforce
To integrate Salesforce with DoControl, first make sure you fulfill these prerequisites in Salesforce:
1. Verify that your Salesforce profile is a system administrator:
* In Salesforce, navigate to **Setup > Profiles > System administrators > Assigned users**.
* Check that you are listed as an assigned user.
2. Check that you have the required [user permissions](https://help.salesforce.com/s/articleView?id=sf.connected_app_create_api_integration.htm\&type=5).
* Under the System Administrator Profile, click the **Settings** icon, and select **System permissions**.
* Use the search bar to look up assigned permissions. The integrator must have the **View all data** permission.
3. Make sure these user permissions are assigned to you:
| Salesforce system permission | Description |
| ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| View all data | View all organizational data, regardless of sharing settings |
| Query all files | Retrieve all files in the organization |
| Modify all data (optional) |
Relevant for allowing remediation actions.
Create, edit and delete all organization data, regardless of sharing settings
|
{% hint style="info" %}
As a system administrator, most of the permissions should be preset, but they might have been adjusted by a super admin user.
{% endhint %}
4. Proceed to the next section: [Enable event monitoring in Salesforce](#enable-event-monitoring-in-salesforce) (Premium module) OR [Integrate Salesforce with DoControl](#integrate-salesforce-with-docontrol).
## Enable event monitoring in Salesforce
If you want to receive real-time security events in DoControl, you need to enable the Event Monitoring functionality in Salesforce.
{% hint style="success" %}
Salesforce Event Monitoring is a DoControl Premium module. To enable it, please contact Customer Success.
{% endhint %}
1. Make sure these stream subscriptions are assigned to you:
* **APIAnomalyEventStore** - Tracks anomalies in how users make API calls.
* **APIEvent** - Tracks these user-initiated read-only API calls: query(), queryMore(), and count()
* **BulkApiResultEventStore** - Tracks when a user downloads the results of a Bulk API request
* **CredentialStuffingEventStore** - Tracks when a user successfully logs into Salesforce during an identified credential stuffing attack
* **FileEventStore** - Tracks when a user downloads, previews, or uploads a file
* **IdentityVerificationEvent** - Tracks user identity verification events in your organization
* **IdentityProviderEventStore** - Tracks problems and successes with inbound SAML or OpenID Connect authentication requests from another app provider
* **LightningUriEvent** - Detects when a user creates, accesses, updates, or deletes a record in Lightning Experience only
* **ListViewEvent** - Tracks when users access data with list views using Lightning Experience, Salesforce Classic, or the API
* **LoginAsEvent** - LoginAsEvent tracks when an admin logs in as another user in your organization
* **LoginEvent** - LoginEvent tracks the login activity of users who log into Salesforce.
* **LogoutEvent** - Tracks user UI logouts. A logout event records a successful user logout from your organization's UI.
* **PermissionSetEventStore** - Tracks changes to permission sets and permission set groups. This event initiates when a permission is added to, or removed from a permission set. This event also initiates when a permission set containing a critical permission is assigned or unassigned.
* **ReportAnomalyEvent** - Tracks anomalies in how users run or export reports, including unsaved reports
* **ReportAnomalyEventStore** - Tracks anomalies in how users run or export reports, including unsaved reports
* **ReportEvent** - Tracks when reports are run in your organization. You can use ReportEvent in a transaction security policy.
* **SessionHijackingEventStore** - Tracks when unauthorized users gain ownership of a Salesforce user’s session with a stolen session identifier. To detect such an event, Salesforce evaluates how significantly a user’s current browser fingerprint diverges from the previously known fingerprint using a probabilistically inferred significance of change.
* **UriEvent** - Detects when a user creates, accesses, updates, or deletes a record in Salesforce Classic only
{% hint style="info" %}
For more information, see [Salesforce event monitoring](https://help.salesforce.com/s/articleView?id=sf.real_time_event_monitoring_overview.htm\&type=5).
{% endhint %}
2. To enable the above stream subscriptions, navigate to the **Setup** section.
3. Enter **Events** in the Quick Find box, then select Event Manager.
4. Next to the specific events you want to enable, click the dropdown menu and enable **Storing data for the entire list for optimal coverage**.
5. Proceed to the next section: [Integrate Salesforce with DoControl](#integrate-salesforce-with-docontrol).
## Integrate Salesforce with DoControl
Before starting to integrate, you need to sign up with DoControl. Follow the onboarding steps in [Create first account](/docontrol-user-guide/getting-started/quick-start/set-up-docontrol-basics.md#create-first-account).
1. From the DoControl side menu, click **Integrations**.
2. Under **Salesforce**, click **Connect**. The Salesforce wizard opens.
3. Select the Salesforce environment you want to connect to:
* **Sandbox** or
* **Production**
4. Click **Next**.
5. Login to Salesforce using your user credentials.\
Salesforce is now integrated with DoControl.
6. Configure the [OAuth scope settings ](#configure-oauth-scope-settings)in the next procedure.
## Configure OAuth scope settings
After you integrate Salesforce with DoControl, make sure you configure these OAuth scope permissions to operate DoControl together with Salesforce:
* Access the identity URL service
* Manage user data via APIs
* Manage user data via web browsers
* Access Connect REST API resources
* Access Visualforce applications
* Access unique user identifiers
* Access custom permissions
* Access Analytics REST API resources
* Access Analytics REST API Charts Geodata resources
* Manage hub connections
* Manage Pardot services
* Access Lightning applications
* Access content resources
* Manage Salesforce CDP Ingestion API data
* Manage Salesforce CDP profile data
* Perform ANSI SQL queries on Salesforce CDP data
* Perform requests at any time
{% hint style="info" %}
For more information see Salesforce documentation: [permission scopes](https://help.salesforce.com/s/articleView?id=sf.connected_app_create_api_integration.htm\&type=5) and [events](https://help.salesforce.com/s/articleView?id=sf.real_time_event_monitoring_overview.htm\&type=5).
{% endhint %}
## Troubleshooting
Q. What happens if my Salesforce token expires?
A. If the person who performed the integration leaves your organization, your Salesforce token will expire. You need to reconnect to DoControl by performing the [integration procedure](#integrate-salesforce-with-docontrol) again.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.docontrol.io/docontrol-user-guide/integrations/salesforce.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
icon, and select **System permissions**.
* Use the search bar to look up assigned permissions. The integrator must have the **View all data** permission.