--- title: Salesforce description: Collect Salesforce real-time platform events as Datadog logs. breadcrumbs: Docs > Integrations > Salesforce --- # Salesforce Integration version1.2.1 Salesforce Overview DashboardSalesforce Event Logs ## Overview{% #overview %} Salesforce provides a customer relationship management service and a complementary suite of enterprise applications focused on customer service, marketing automation, analytics, and application development. The Salesforce integration collects event logs through the [Event Log File (ELF)](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile.htm) API and [Real-Time Event Monitoring](https://help.salesforce.com/s/articleView?id=xcloud.real_time_event_monitoring_overview.htm&type=5) stream to provide visibility into your Salesforce environment. This integration helps you track user actions like logins, logouts, and identity verification. This includes support for a wide variety of event types, such as standard events, log files, and custom platform events. You can also ingest [Custom Objects](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_custom_objects.htm) and [Custom Platform Events](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/platform_events_intro.htm) as logs. Custom Objects are collected through periodic polling, while Custom Platform Events are streamed in real-time using Salesforce's Pub/Sub API, providing near-instant visibility into your custom business events as they occur. The integration works seamlessly with both the default events defined by Salesforce and the custom events or objects that customers configure specifically in their own instances. Integrate Salesforce with Datadog to: - View and parse your Salesforce user activity, platform access activity, and security logs using [Datadog Log Management](https://docs.datadoghq.com/logs/). - Set [monitors](https://docs.datadoghq.com/monitors/monitor_types/) on [events](https://docs.datadoghq.com/events/) from your Salesforce Platform. - Monitor your Salesforce API usage to ensure you are operating under API limits and to prevent issues like hitting API limits. - Use [Cloud SIEM](https://www.datadoghq.com/dg/security/siem-solution/?utm_source=google&utm_medium=paid-search&utm_campaign=dg-security-na-siem&utm_keyword=cloud%20siem&utm_matchtype=p&igaag=132461095403&igaat=&igacm=15832880540&igacr=596304643080&igakw=cloud%20siem&igamt=p&igant=g&utm_campaignid=15832880540&utm_adgroupid=132461095403&gad_source=1&gad_campaignid=15832880540&gbraid=0AAAAADFY9Nk4R9kufMZrEHHWbK5eqZZx2&gclid=CjwKCAjw9anCBhAWEiwAqBJ-c0nfgfSoSTYESZQYWMFFq8d9Rci-lAqvm2nd_v7dFV-xfXHk4XeEiBoCXJ4QAvD_BwE) to correlate events, detect advanced threats, and investigate suspicious activity more efficiently. - Enrich your telemetry with metadata from your Salesforce instance using Datadog [Reference Tables](https://docs.datadoghq.com/reference_tables/?tab=manualupload). By mapping value fields to a primary key, you can automatically append these fields to logs or events containing that key. Datadog automatically parses Salesforce logs, so you can filter by User ID, IP Address, or Salesforce Entity to identify anomalies, like suspicious login attempts or unusual activity. The integration also includes an out-of-the-box dashboard for monitoring activity, which you can customize to meet your needs. Use Datadog's analysis tools to monitor your Salesforce logs and improve security, performance, and operational insights. ## Setup{% #setup %} No installation is required. To configure Salesforce to send data to Datadog, you need to have access to [Salesforce Event Monitoring](https://trailhead.salesforce.com/content/learn/modules/event_monitoring), enable storage on your Salesforce events, and connect your Salesforce org to Datadog. {% alert level="info" %} An administrator with [Salesforce admin privileges](https://admin.salesforce.com/blog/2025/get-ready-for-changes-to-connected-app-usage-restrictions) must be the one to authorize the Datadog connected app (Step 3: Connect Your Org, below). Complete Steps 1-2 first to ensure events are available when the connection is established. After the initial configuration, you can optionally choose to assign the integration to a non-admin user. {% /alert %} ### Step 1: Check permissions{% #step-1-check-permissions %} If you are using [Salesforce Shield](https://www.salesforce.com/editions-pricing/platform/shield), you have the required permissions for all events. If you do not have Shield, you need the [Event Monitoring add-on](https://help.salesforce.com/s/articleView?id=000339868&type=1). ### Step 2: Enable event storage{% #step-2-enable-event-storage %} If you plan on using the platform or real-time events, you need to set this up in the Event Manager. This step is not required for event log file events. 1. [Log into](https://login.salesforce.com/) your Salesforce account (using the Lightning interface). 1. Search for **Event Manager**. 1. On the Event Manager page, for each event you want to crawl, click the right arrow and select **Enable Storage**. You do not need to **Enable Streaming**. The list of supported events can be found under the **Platform Events** section in the **Configuration** tab of the [Salesforce Integration tile](https://app.datadoghq.com/integrations/salesforce). ### Step 3: Connect your org{% #step-3-connect-your-org %} 1. Create a unique system account in your Salesforce org. 1. Click **New Production Org** or **New Sandbox Org** in the **Configuration** tab of the [Salesforce Integration tile](https://app.datadoghq.com/integrations/salesforce). - (Optional) Enter your Salesforce custom login domain only if your organization uses one (for example, `your-domain.my.salesforce.com`). Leave the toggle disabled to continue with the standard login. - (Optional) Set any custom tags you want to attach to these events as a comma-separated list. - (Optional) Choose which events to enable. 1. Click **Connect**. This prompts you to log into your Salesforce account and grant Datadog access permissions. 1. Once you have completed the login flow, return to the [Salesforce Integration tile](https://app.datadoghq.com/integrations/salesforce) in Datadog. Your org includes out-of-the-box default tags. 1. Select the tags you want to use and click **Save All Changes**. 1. Repeat these steps to connect your remaining organizations. You must have access to the organizations you are trying to add. **Note**: A default tag is added with your Salesforce org ID, but you can edit [the tags](https://docs.datadoghq.com/getting_started/tagging/using_tags/) with something more meaningful to your company. #### (Optional) Reassign the integration to a non-admin user{% #optional-reassign-the-integration-to-a-non-admin-user %} After connecting your Salesforce organization to Datadog initially, you no longer need Salesforce admin privileges to manage the integration, and you can choose to reassign to a different user: Once the Datadog Connected App appears in Salesforce under **Setup > Manage Connected Apps**, configure its OAuth policies: 1. Set **Permitted Users** to **Admin approved users are pre‑authorized**. 1. Assign the app to your least‑privileged service user through **Setup > Profiles** or **Setup > Permission Sets**. 1. Back in **Manage Connected Apps**, set the **Refresh Token Policy** to **valid until revoked**. 1. Restore any IP restrictions as required by your security policies. 1. After these policies are in place, disconnect the integration in the Datadog Salesforce tile and reconnect using the service user's credentials to rotate the tokens to that account. ### (Optional) Add Salesforce Custom Objects{% #optional-add-salesforce-custom-objects %} To ingest [Salesforce Custom Objects](https://help.salesforce.com/s/articleView?id=platform.dev_objectcreate_task_parent.htm&type=5) into Datadog: 1. On the Salesforce integration tile, open the **Custom Objects** section. 1. Add one or more Custom Objects, in the Salesforce API format (`CustomObject__c`), separated by commas (`CustomObject1__c, CustomObject2__c`). 1. Enable or disable these Custom Objects as you would other Salesforce events. Custom Objects are ingested as logs, based on modification date. All Custom Object logs are automatically tagged with `salesforce_custom_object:true`. ### (Optional) Add Salesforce Platform Custom Events{% #optional-add-salesforce-platform-custom-events %} To stream [Salesforce Custom Platform Events](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/platform_events_intro.htm) to Datadog in real time: 1. On the Salesforce integration tile, open the **Custom Events** section. 1. Add one or more Custom Platform Events in the Salesforce API format (`CustomEvent__e`), separated by commas (`CustomEvent1__e, CustomEvent2__e`). 1. Enable or disable these Custom Events as you would other Salesforce events. Custom Events are ingested as logs and streamed in real time using Salesforce's Pub/Sub API. All Custom Event logs are automatically tagged with `salesforce_custom_event:true`. ### Step 4: Verify results{% #step-4-verify-results %} After some time, [logs](https://docs.datadoghq.com/logs/) appear under the `salesforce` source. Salesforce writes the event log files infrequently, so it may take an hour or more for event log file-based events to appear in Datadog. ### (Optional) Enable ingestion of reference tables{% #optional-enable-ingestion-of-reference-tables %} #### Identify the tables and fields you want to import{% #identify-the-tables-and-fields-you-want-to-import %} 1. In Salesforce, open **Object Manager** 1. Select object to be ingested into Datadog 1. Select **Fields and Relationships** of object #### Define and validate your Salesforce query{% #define-and-validate-your-salesforce-query %} 1. Open [Developer Console](https://help.salesforce.com/s/articleView?id=platform.code_dev_console_tab_query_editor.htm&type=5) in Salesforce 1. Build and test query in **Developer Console** selecting desired fields from object **Query Limitations**: When querying Salesforce reference tables, only direct (flat) fields listed in the [Salesforce object reference](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_concepts.htm) are supported. **Supported**: Standard or custom fields on the object itself (for example, `FieldName` or `CustomField\_\_c`) **Not Supported**: Nested fields or references, such as `RelatedObject.Field` **Example**: ``` -- Supported SELECT Id, AccountId, OwnerId, Name FROM Contact ``` ``` -- Not Supported SELECT Id, Account.Name, Owner.Name FROM Contact ``` See the official [Salesforce Object Reference docs](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_concepts.htm) to verify which fields are directly available on an object. #### Define your Datadog Reference Table with your Salesforce query{% #define-your-datadog-reference-table-with-your-salesforce-query %} 1. In Datadog, navigate to Salesforce tile and select existing account or add new account. 1. Click **Add New Reference Table**. 1. Enter a unique name for **Table Name**. 1. Select a field in the query with unique values and enter that as **Primary Key**. 1. Copy the working query from **Salesforce Developer Console** into **Salesforce Query**. 1. Click **Save All Changes**. #### Troubleshooting ingestion of reference tables{% #troubleshooting-ingestion-of-reference-tables %} - Reference table fields are immutable after creation. To make changes, delete and recreate the table with the desired schema. - Data ingestion begins shortly after execution. You should see data populated in Datadog within a few minutes of the scheduled query running. - Monitor ingestion with the [Events Explorer](https://app.datadoghq.com/event/explorer). Use the query `source:salesforce` to filter for relevant Salesforce sync events. - Verify your table in [Reference Tables](https://app.datadoghq.com/reference-tables). Search by your specified Table Name to confirm the table was created and is receiving data. ## Data Collected{% #data-collected %} ### Metrics{% #metrics %} | | | | | **salesforce.limits.max**(gauge) | The maximum limit for this resource | | **salesforce.limits.remaining**(gauge) | The remaining limit for this resource | ### Logs{% #logs %} This integration allows you to view logs generated from Salesforce user activity, platform access activity, and security using [Datadog Log Management](https://docs.datadoghq.com/logs/). For the full list of supported activity, see [Real-Time Event Monitoring Data Storage](https://developer.salesforce.com/docs/atlas.en-us.securityImplGuide.meta/securityImplGuide/real_time_event_monitoring_storage.htm#storage-events) and [EventLogFile Events](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile_supportedeventtypes.htm). This information can also be found on the **Data Collected** tab of your Salesforce Integration Tile. ### Service Checks{% #service-checks %} The Salesforce integration does not include any service checks. ### Events{% #events %} This integration does not include any events. ## Troubleshooting{% #troubleshooting %} If you encounter an `The authenticated connection does not have access` error in the Configuration tab, you may be missing permissions to access requested events. You can temporarily enable admin permissions for the Datadog role in Salesforce to confirm any missing access permissions. At a minimum, the user must have the following permissions: - API Enabled - View Setup and Configuration - View Real-Time Event Monitoring Events - View Event Log Files - View Threat Detection Events The user must also have read permission on any underlying event objects that are selected in the configuration. Need help? Contact [Datadog support](https://docs.datadoghq.com/help/). ## Further Reading{% #further-reading %} - [Monitor Salesforce logs with Datadog](https://www.datadoghq.com/blog/monitor-salesforce-logs-datadog/) - [Salesforce](https://docs.datadoghq.com/integrations/salesforce/)