Salesforce Real-Time Events (Beta)

Panther supports ingesting Salesforce Real-Time events via EventBridge

Overview

The Salesforce Real-Time Events integration is in open beta starting with Panther version 1.117, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.

Panther supports ingesting Salesforce Real-Time Events for monitoring activity in your Salesforce account in real-time. This integration uses Amazon EventBridge to stream events directly from Salesforce to Panther.

This integration is separate from the Salesforce Event Monitoring integration where logs are pulled periodically.

Salesforce Limitations

You can create a maximum of three custom channels for Real-Time Event Monitoring.
Each event channel is limited to 10 events.
- If you need to monitor more than 10 event types, you must distribute them across multiple channels.
With a maximum of three custom channels and 10 events per channel, you can monitor up to 30 event types total.

How to onboard Salesforce logs to Panther

Prerequisites

You must be an admin in your Salesforce organization.
Your Salesforce organization must have Real-Time Event Monitoring enabled. You must have:
- The Salesforce Shield or Event Monitoring add-on subscription.
- The View Real-Time Event Monitoring Data user permission.

Step 1: Configure Salesforce Event Streaming

Log in to Salesforce as an administrator.
In the top-right, click on the gear icon, then Setup.
In the search box, enter and select Event Manager.

Salesforce search bar showing "Event Manager"

For each event you want to send to Panther, click the arrow on the right-hand side, then select Enable Streaming.

Step 2: Create Event Relays

Once you have enabled event streaming, you need to create Event Relays to send the data to AWS EventBridge.

You have two options for creating Event Relays:

Option 1 (Recommended): Using an automated script to create Event Relays
Option 2: Manually creating Event Relays

Option 1 (Recommended): Using an automated script to create Event Relays

Download one of the following script. These scripts will add all event types and create the related Event Relays.

Before running the script, configure the following variables:

USERNAME="YOUR_USER_MAME"
PASSWORD="YOUR_PASSWORD"
SECURITY_TOKEN="YOUR_SECURITY_TOKEN"
LOGIN_BASE="https://login.salesforce.com"  # or test.salesforce.com for sandbox
API_VERSION="v64.0"
AWS_REGION="YOUR_AWS_REGION"  # Must be in capital
AWS_ACCOUNT_ID="YOUR_AWS_ACCOUNT_ID"

You can get your AWS region and account ID from the Panther Console.
- Click the gear icon in the upper right corner of your Panther Console and then select General. Your AWS information will be displayed at the bottom of the page.

Run the script. Copy the AWS EventBridge resources from the script output. You will need them in the following steps.
In Salesforce, the Event Relays page should show your configured relays.

Option 2: Manually creating Event Relays

For more detailed instructions, refer to the Relay Events from Salesforce to Amazon EventBridge guide.

Follow the Salesforce instructions to Create a Named Credential for Event Relay Setup.
- Fill in the following fields:
  - Label: PantherAWSNamedCredential
  - Name: PantherAWSNamedCredential
  - URL: arn:aws:events:YOUR-REGION:YOUR-ACCOUNT-ID
    You can get your AWS region and account ID from the Panther Console.
    Click the gear icon in the upper right corner of your Panther Console and then select General. Your AWS information will be displayed at the bottom of the page.
  - Identity Type: Named Principal
  - Authentication Protocol: No Authentication
Follow the Salesforce instructions to Connect Postman to Salesforce.
Follow the Salesforce instructions to Create a Channel for a Custom Platform Event with Postman.

For each event types, follow the Salesforce instructions to Add a Custom Platform Event in a New Channel Member.

Body example:

{
  "FullName": "Event_Monitoring_Channel_chn_ReportAnomalyEvent",
  "Metadata": {
    "eventChannel": "Event_Monitoring_Channel__chn",
    "selectedEntity": "ReportAnomalyEvent"
  }
}

You can't add the ApiEventStream or ReportEventStream Real-Time Event Monitoring events to a custom channel via Tooling API because they aren't available in Tooling API. You must add them via Metadata API instead. For more information, refer to the Platform Events Developer Guide.

Follow the Salesforce instructions to Create an Event Relay.
Follow the Salesforce instructions to Start the Event Relay.
In Salesforce, navigate to the Event Relays page. Copy the Partner Event Source Name from each Event Relay. You will need them in the following steps.

Step 3: Verify that all Event Relays are running in Salesforce

To check the status of Event Relays:

In Salesforce, navigate to Setup → Event Relays.
Confirm that all Event Relays show "Running" in the Status column.

Only proceed to Step 4 once all Event Relays are confirmed as running. If Event Relays are not running, you won't be able to set up the log source in Panther.

Step 4: Configure the Salesforce Real-Time log source in Panther

In the left-hand navigation bar of your Panther Console, click Configure > Log Sources.
Click Create New.
Select Salesforce Real-Time from the list of available log sources. Click Start Setup.
On the Configure you source page, fill in the following fields:
- Name: Enter a descriptive name for the source (e.g., Salesforce Real-Time Events).
- EventBridge Bus Names: Enter the AWS EventBridge resources or Partner Event Source Names you copied earlier.
  - Add additional bus names by clicking Add Bus Name.
Click Setup.

Supported event types

The Salesforce Real-Time Events integration supports the following monitoring events:

Supported events

LoginEventStream - Real-time user login events
LogoutEventStream - Real-time user logout events
LoginAsEventStream - Real-time login as events
SessionHijackingEventStream - Session hijacking detection events
CredentialStuffingEventStream - Credential stuffing attack attempts
ReportEventStream - Report access and modification monitoring
ListViewEventStream - List view access events
UriEventStream - URI access events (Salesforce Classic)
LightningUriEventStream - Lightning URI access events
ApiEventStream - API access events
ApiAnomalyEventStream - API anomaly detection events
ReportAnomalyEventStream - Report anomaly detection events
LoginAnomalyEventStream - Login anomaly detection events
GuestUserAnomalyEventStream - Guest user anomaly detection events
BulkApiResultEventStream - Bulk API operation results
FileEventStream - File access and download events
PermissionSetEventStream - Permission set assignment and modification events
ConcurrentLongRunningEventStream - Concurrent long-running event monitoring

The event type is specified in the Type field of each event, allowing you to filter and create detection rules based on specific event types.

Supported log types