Introduction

This article describes the Field Effect MDR integration with REPLACE. This article covers the following:

• Integration Details
• Requirements
• Setting up the Integration

Integration Details

Integrating Salesforce with Field Effect MDR allows it to monitor your organization’s Salesforce user activity to help identify suspicious or abnormal events. This is done by monitoring specific user activities that could be indicators of compromise such as logins, password changes, and downloads. When an event is identified as abnormal or suspicious, an ARO is issued.

For an exact list of what type of data Field Effect MDR is requesting from Salesforce, see the screenshot below in Setting Up the Integration.   

Requirements

To complete this integration, you will need:

• One of the following Salesforce licenses: 
  • Enterprise Edition 
  • Unlimited Edition 
  • Developer Edition 
  • Performance Edition
• A Salesforce administrator account and credentials
• Administrator access to the Field Effect MDR Portal  

Due to a lack of API access, the following Salesforce licenses are not supported for this integration: Group edition, Essentials edition, and Professional Edition (unless API access has been specifically purchased as an add-on).

Setting up the Integration

Note for Partners: This procedure is performed on a per-client basis. Ensure that the Organization Selector is set to the appropriate client before continuing.

Navigate to the Administration Integrations page. From the Cloud Monitoring tab and click Add within the Salesforce card.

You’ll be taken to a Salesforce login screen. Provide admin account credentials for your Salesforce account and continue.

You’ll then see a screen asking you to allow Field Effect to monitor Salesforce telemetry. Click Allow to complete the integration.

You'll be taken back to the integrations page, and the integration card will show that the integration is connected and promoted to the top, alongside any other connected integrations.