Salesforce AuditTrail

Collect audit trail logs from Salesforce to monitor setup changes and administrative actions.

The Salesforce Audit Trail source works by polling your Salesforce Audit Trail logs every 15 minutes. Salesforce stores Audit Trail logs for 180 days, RunReveal will backfill your Salesforce Audit Trail logs with everything that is available.

Ingest Methods

RunReveal offers the following ways to ingest Salesforce AuditTrail logs:

• API Polling

API Polling

Salesforce AuditTrail supports API polling to collect audit logs from your Salesforce account using OAuth 2.0 client credentials.

Step 1: Create the External Client App

1. In Salesforce, go to Setup (click the gear icon)
2. In the Quick Find box, search for “External Client App Manager”
3. Click “New External Client App” in the top right
4. Fill in the basic information:
   • Connected App Name: Your integration name (e.g. “RunReveal”)
   • API Name: Auto-fills based on the name
   • Contact Email: Your email

Step 2: Configure OAuth Settings

1. Check “Enable OAuth Settings”
2. Set Callback URL to: https://login.salesforce.com/services/oauth2/callback
3. Under Selected OAuth Scopes, add the following scopes:
   • Perform requests at any time (refresh_token, offline_access)
   • Manage user data via APIs (api)
4. Check “Enable Client Credentials Flow”
5. Click “Create”

Step 3: Enable Client Credentials Flow

1. Edit the app you just created
2. Check “Enable Client Credentials Flow”
3. In the “Run As” field, search for and select the execution user

Step 4: Save and Retrieve Credentials

1. Click “Save”
2. Click “Continue” on the confirmation page
3. You’ll see the Consumer Key displayed immediately
4. Click “Manage Consumer Details” to view the Consumer Secret
5. Salesforce will send a verification code to your email — enter it to proceed

Step 5: Connect in RunReveal

1. Go to Sources in RunReveal
2. Click the Salesforce AuditTrail source tile
3. Give it a name and fill in the required fields:
   • Salesforce Instance Host: Your Salesforce instance URL (e.g. company.my.salesforce.com)
   • Client ID: The Consumer Key from Step 4
   • Client Secret: The Consumer Secret from Step 4
4. Click Connect Source

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Related Documentation

For more information on configuring and using the Salesforce AuditTrail source:

• External Client Apps in Salesforce - Step-by-step guide to creating the Connected App and retrieving your Client ID and Client Secret
• SetupAuditTrail Object Reference - Salesforce developer documentation for the SetupAuditTrail object that RunReveal queries