Review Salesforce Events in Tenable Security Center
To review Salesforce Events in Tenable Security Center:
-
Navigate to Tenable Security Center and log on with a user account that has permission to view logs for the organization.
A dashboard that corresponds to the user role appears.
-
In the top navigation bar, click Analysis, and then click the Events link.
The Event Analysis page appears, displaying the Type Summary section.
-
Click the Type Summary button, and then select Normalized Event Summary.
The Normalized Event Summary section appears.
-
In the upper-left corner of the page, click .
The Filters pane appears.
-
Click the Select Filters button, and then, in the Add Filter popout, select Normalized Event.
-
Click the Apply button.
-
Click the Normalized Event box, and then, in the Normalized Event text box, type Salesforce-*.
-
Click OK.
-
In the Filters pane, click the Apply All button.
In the Normalized Event Summary section, the list of events is filtered and displays only events that start with Salesforce-.
For Salesforce, the Web Query Client monitors login successes and failures, and the creation and modification of user accounts. For a list of specific events, click a Salesforce event type (e. g., Salesforce-Remote_Access_Login) listed in the Normalized Event Summary section. You can also click the Jump to Raw Syslog Events link to directly view the log data.