Salesforce Event Logs

Capture detailed information about user activities, system operations, and performance metrics within a Salesforce organization.

Ingest Methods

RunReveal offers the following ways to ingest Salesforce Event Logs logs:

• API Polling

API Polling

Salesforce Event Logs supports API polling to collect event logs from your Salesforce organization using OAuth 2.0 client credentials. The setup steps are the same as for Salesforce Audit Trail; you can use the same Connected App credentials for both Event Logs and Audit Trail if you want to run both sources.

Step 1: Create the External Client App

1. In Salesforce, go to Setup (click the gear icon)
2. In the Quick Find box, search for “External Client App Manager” (or go to Apps → External Client Apps → External Client App Manager in the sidebar)
3. Click “New External Client App” in the top right
4. Fill in the basic information:
   • Connected App Name: Your integration name (e.g. “RunReveal”)
   • API Name: (auto-fills based on the name)
   • Contact Email: Your email

Step 2: Configure OAuth Settings

1. Check “Enable OAuth Settings”
2. Set Callback URL to: https://login.salesforce.com/services/oauth2/callback (or your specific callback URL if different)
3. Under Selected OAuth Scopes, add:
   • Perform requests at any time (refresh_token, offline_access)
   • Manage user data via APIs (api)
4. Check “Enable Client Credentials Flow”
5. Click “Create”

Step 3: Enable Client Credentials Flow

1. Edit the app you just created
2. Check “Enable Client Credentials Flow”
3. In the “Run As” field, search for and select the execution user

Step 4: Save and Retrieve Credentials

1. Click “Save”
2. Click “Continue” on the confirmation page
3. You’ll see the Consumer Key displayed immediately
4. Click “Manage Consumer Details” to view the Consumer Secret
5. Salesforce will send a verification code to your email — enter it to proceed
6. Copy both the Consumer Key and Consumer Secret for use in RunReveal

Step 5: Connect in RunReveal

1. Go to Sources in RunReveal
2. Click the Salesforce Event Logs source tile
3. Give it a name and fill in the required fields:
   • Salesforce Instance Host: Your Salesforce instance URL (e.g. company.my.salesforce.com)
   • Client ID: The Consumer Key from Step 4
   • Client Secret: The Consumer Secret from Step 4
4. Click Connect Source

RunReveal will poll the Salesforce Event Logs API daily and backfill the last 30 days on first sync.

Video Walkthrough

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.