Salesforce

Use cases the adapter solves

The Salesforce adapter can be used for:

• User management - Review users’ statuses, permissions, and activity. identify gaps in offboarding users and in user access levels.

• Security management - Find misconfigurations that pose security and compliance risks.

• Cost optimization - Identify cost optimization opportunities.

Related Enforcement Actions

These actions can help when you want users to be suspended or to create a Salesforce case from Axonius.

Salesforce - Create Case

Salesforce - Suspend User

APIs

Axonius uses the Salesforce API .

This adapter fetches the following types of assets:

• Users

• SaaS data

Permissions in Salesforce should be configured by the user in your organization with the System Administrator role in Salesforce.

• The value supplied in User Name must have permissions to fetch assets, as per Create a Secure Salesforce API User .

• Make sure that you have Enabled Delegated Authentication in your Salesforce environment.

• The value supplied in Consumer Key must be associated with credentials that have permissions to fetch assets. To create a consumer key, follow the Authorization Setup .

• Salesforce user permissions (for more information see Create a User Profile ):

  • Every permission from the General User section starting with the word "View" except for View Encrypted Data.

  • Lightning Experience User

  • API Enabled

  • Manage IP addresses

  • Manage Login Access Policies

  • Manage Password Policies

  • Manage Profiles and Permissions Sets

  • Manage Roles

  • Manage Sandboxes

  • Manage Sharing

  • View All Profiles

  • View All Users

  • Apex REST Services

  • Manage Users

  • Manage Connected Apps

  • Modify Metadata Through Metadata API Functions

  • Customize Application

  • Is Single Sign-On Enabled

• API Permissions - Full access (full) scope. For more information see Create an API Client.

• To fetch SaaS data, the user you create must have permission to access the following URLs:

  • https://{account}.lightning.force.com/lightning/setup/EnhancedProfiles/home

  • https://{account}.lightning.force.com/lightning/setup/SecuritySession/home

  • https://{account}.lightning.force.com/lightning/setup/SecurityPolicies/home

  • https://{account}.lightning.force.com/lightning/setup/LoginAccessPolicies/home

  • https://{account}.lightning.force.com/lightning/setup/IdentityVerification/home

  • https://{account}.lightning.force.com/lightning/setup/FileTypeSetting/home

  • https://{account}.lightning.force.com/lightning/setup/OrgDomain/home

To successfully connect this adapter, you need to complete the following steps.

1. Generate Consumer Key and Secret
   

2. Create a User Profile

3. Create a User Account

4. Generate the User Secret

Generate Consumer Key and Secret

1. In Salesforce, in the Platform Tools menu, navigate to Apps > App Manager.

2. Click New Connected App.

3. Fill in the Connected App Name, API Name and Contact Email fields as you like.

4. Select the Enable OAuth Settings checkbox.

5. Select the Enable for device flow checkbox.

6. Under Selected OAuth Scopes section, select Full access (full) scope and click to add it.

   

7. Click Save.

8. Navigate to Apps > App Manager.

9. Locate the app you just created. In its drop-down menu, select View.
   

   

   
   

10. In the app, click Manage Consumer Details.

    

11. In the Consumer Key field, click Copy.

12. Back in Axonius, copy the pasted key in the Consumer Key field.

13. In Salesforce, in the Consumer Secret field, click Copy.
    

14. Back in Axonius, copy the pasted secret in the Consumer Secret field.

15. In Salesforce, in the app that you created, click Manage.

16. Click Edit Policies.

17. From the IP Relaxation drop-down list, select Relax IP restrictions.

18. Click Save.

Create a User Profile

Before you create a user account for connecting the adapter, you need to configure a user profile so the user you create will have the right permissions and password policies.

1. Navigate to Users > Profiles.

2. Locate the System Administrator profile and in that row, click Clone.

3. Enter a profile name (for example, Axonius).

4. Click Save.

5. Set Permissions for the profile: a. In the profile, click Edit.

   a. Configure the permissions so that the following permissions are selected:

   • Every permission from the General User section starting with the word "View" except for View Encrypted Data.

     

   • Lightning Experience User

   • API Enabled

   • Manage IP addresses

   • Manage Login Access Policies

   • Manage Password Policies

   • Manage Profiles and Permissions Sets

   • Manage Roles

   • Manage Sharing

   • View All Profiles

   • View All Users

   • Apex REST Services

   • Manage Users

   • Manage Connected Apps

   • Modify Metadata Through Metadata API Functions

   • Customize Application

   • Is Single Sign-On Enabled

   b. In the Connected App Access section, select the application you created earlier. placeholder

6. Set the password policy:

   1. Locate the Password Policies section.

   2. From the User Passwords Expire in drop-down list, select Never Expires.

   3. Select Don't immediately expire links in forgot password emails.

   4. Click Save.

   NOTE

   Before performing the following procedure, contact Axonius support for the list of IP ranges to exclude.

7. Configure access to trusted IPs:

   1. In the left-menu, navigate to Security > Network Access.

   2. Click New.

      

   3. Add the Axonius ranges.

   4. Click Save.

8. (For accounts with SaaS Management capabilities) Follow the instructions in this Salesforce video to generate a 2FA Secret Key. Back in Axonius, paste the secret key into the 2FA Secret Key field.

Create a User Account

1. Navigate to Users > Users.

2. Click New User.

3. Fill in information for the new user, in the email field enter an email that you have access to.

4. From the Profile drop-down list, select the profile you just created.

5. Click Save.

6. Copy the user's username.

7. Back in Axonius, in the User Name field, paste the copied Salesforce user name.

8. Set Password:

   1. Open the email you receive from Salesforce.

   2. Click Verify Account.
      

   3. Enter a password for the user.

   4. Copy the password. It's best practice for the password to contain 32 characters.

   5. Enter a security question and answer.

   6. Click Change Password.
      

   7. Back in Axonius, paste the copied password in the Password field.

9. Connect the new user to the user profile you created earlier:

   1. In Salesforce, from the Administration menu, navigate to Users > Users.

   2. Select the user you just created.

   3. From the User License drop-down list, select Salesforce.

   4. From the profile drop-down list, select the profile you created earlier.

   5. Click Save.

Generate the User Secret

This process is only relevant if you did not add trusted IP ranges. For more information, see Reset Your Security Token .

1. Log into Salesforce with an admin account with an email address that you have access to.

2. Open the profile menu and click Settings.

3. From the Left menu, select My Personal Information > Reset My Security Token.

4. Click Reset Security Token.

5. Access the account's email and copy the new token from the Salesforce email.

6. In Axonius, paste the token in the User Secret field.

The parameters that you need to fill out will differ based on the capabilities in your Axonius platform. 'General' pertains to users with Cybersecurity Asset Management and/or SaaS Management capabilities.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection .

General

• Domain (required) - The full URL of the Salesforce server.

• User Name and Password (required) - The credentials for a user account that has the Required Permissions to fetch assets.

• User Secret (required) - The Salesforce security token associated with a user account to fetch assets.

• Consumer Key (required) - A consumer key associated with a user account that has the Required Permissions to fetch assets.

• Consumer Secret (required) - A consumer secret associated with a consumer key.

• Verify SSL - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings .

• HTTPS Proxy (optional) - A proxy to use when connecting to the value supplied in Host Name or IP Address.

• HTTPS Proxy User Name (optional) - The user name to use when connecting to the value supplied in Host Name or IP Address via the value supplied in HTTPS Proxy.

• HTTPS Proxy Password (optional) - The password to use when connecting to the value supplied in Host Name or IP Address via the value supplied in HTTPS Proxy.

SaaS Management

• 2FA Secret Key - The secret generated in Salesforce for setting up 2-factor authentication for the Salesforce user created for collecting SaaS Management data. For more information on how to generate this secret key, see this Salesforce instructional video .

• SSO Username and Password - If your organization accesses Salesforce with an SSO provider (such as Google, Microsoft 365, Okta, etc.) enter your credentials for the SSO platform in the SSO Username and SSO Password fields.

All of the advanced settings apply to environments with Cybersecurity Asset Management and/or SaaS Management capabilities.

• Fetch chatter user data - Select this option to fetch additional information about the chatter user platform.

• Fetch only active users - Select this option to skip all inactive users and only fetch active users.

• Fetch nodes - Select this option to enrich the Account devices field with data from the Opportunity and Contract tables. Axonius always tries to bring devices from the Axonius_Environment__c custom table.

• Only fetch Employee users - Select this option to fetch only "standard" Salesforce users.

• Get "is_admin" by Profile Name - Select this option to fetch the admin role from the user profile name.

• Fetch Tabs - Select this option to fetch Salesforce tabs from the account.

• Fetch user groups - Select this option to fetch users group details.

• Fetch user roles and permissions - Select this option to fetch user roles and permissions configured for the Salesforce accounts in your organization.

• Fetch Audit Events - Toggle on to fetch audit events and show them on Axonius as Activities assets. When you select this option the settings below are available

  • Fetch Audit Events from the past X Days - Select the number of days back from which to fetch Audit events.

    Use the options below to select the type of events to fetch (login, logout, API, Lightning URI, URI). If you do not select these options then these are not fetched at all.