Integrating Salesforce with Reco
Salesforce integration allows Reco to provide visibility and detection of abnormal activities on Salesforce objects and assets. With Reco's business context, you can rest assured that your sales and marketing operations are protected and secure.
Although not mandatory, Salesforce Shield is a subscription service that is required for generating the event logs. This will allow Reco to display useful insights about the activity in your Salesforce account, beyond just objects and permissions.
Prerequisites
A Reco user with an Admin Role
For Salesforce Shield customers - If you're unsure if you have Shield, see this FAQ
Enable Event Monitoring
Login to Salesforce, and click on the Settings Icon on the upper-right side of the screen
At the left-side menu, under "Settings" -> "Security" -> Expand "Event Monitoring" -> Click on "Event Monitoring Settings"
Enable “View event log data in Analytics apps”
Disable “Delete event monitoring data”
At the left-side menu, under "Platform Tools", expand "Events" -> Click on “Event Manager"
Enable streaming and storing for each event, where applicable
Configure Service Account
The following steps describe the creation of an API-only user with the minimum required permissions for integrating Salesforce with Reco. This user is created under a free-for-all license and does not take up user license slots in your account.
Log in to login.salesforce.com.
Go to Administration > Users > Permission Sets in the left navigation bar.
Press on New
Fill in
Label: "Reco Integration"
API Name: "Reco_Integration"
Choose a License: "Salesforce API Integration"
Click Save.
Click on "System Permissions"
Click on "Edit"
Enable all the following permissions:
Manage Connected Apps
Manage Custom Permissions
Modify Metadata Through Metadata API Functions
View all External Client Apps
View all External Client Apps, view their settings, and edit their policies
View Event Log Files
View Event Log Object Data
View Login Forensics Events
View Real-Time Event Monitoring Data
View Roles and Role Hierarchy
View Setup and Configuration
Click on "Save"
Search for each of the following items in the "Find Settings..." search box of the Permission Set page, click on "Edit", set the "Object Settings" as "View All", and click on "Save":
API Anomaly Event Stores
Guest User Anomaly Event Stores
Report Anomaly Event Stores
Session Hijacking Event Stores
After creating the custom Permission Set, Go to Administration > Users > Users
Click on "New User"
Inside the "New User" form, fill in:
Last Name: "Reco Integration"
Alias: Reco
Email: Provide a dedicated email address for the integration user of your choosing. This address can also be an alias.
User License: "Salesforce Integration"
Profile: "Salesforce API Only System Integrations"
Click on "Save"
At this point, Salesforce should send a verification email to the specified address above. Follow the instructions provided in the email to finish the user creation.
In the created user page, under "Permission Set Assignments", click on "Edit Assignments"
From the "Available Permission Sets" choose "Reco Integration", click on "Add", and then on "Save".
Trusted IP Range
Reco recommends allowing a pool of Reco public IP addresses in Salesforce. This will ensure that Salesforce and Reco exchange events and notifications. To allow the IP addresses:
Log in to login.salesforce.com.
In the left navigation bar, go to Settings > Security > Network Access.
Click New beside Trusted IP Ranges.
In the Trusted IP Range Edit page, specify the Start IP Address and End IP Address.
Click Save.
To get a pool of Reco public IP addresses, talk with Reco Support.
Integrate Salesforce with Reco
In a separate browser/profile:
Log in to the service account you've created above
Log in to the Reco Platform
Click on "Configurations" then click on "Integrations"
Locate the "Salesforce" object and click on "Add Integration"
You will then be redirected to your Salesforce tenant consent page, Click on "Allow"
You will be then redirected back to the Reco platform.
Grant Failure Due to Login IP Range
The grant of access may fail if the Salesforce username has any Login IP Ranges configured in Salesforce. Log in to your Salesforce account and verify if the user profile associated with the username has Login IP Ranges configured. If configured, follow the procedure below to ensure the grant goes through successfully.
Log in to login.salesforce.com.
On the top right, click Setup > Setup.
On the left navigation pane, search for Connected Apps > Connected Apps OAuth Usage.
Beside the Reco Introspection for Salesforce app, click Install.
A new window opens. Click Install.
On the Reco Introspection for Salesforce Connected app page, click Edit Policies.
Under OAuth Policies, set IP Relaxation to Relax IP restrictions.
Click Save.
What do we ingest exactly?
Permission | API / Object |
Access Analytics REST API Charts Geodata resources | eclair_api |
Access Analytics REST API resources | wave_api |
Access Connect REST API resources | chatter_api |
Access the identity URL service | id, profile, email, address, phone |
Access unique user identifiers | OpenID |
Manage user data via APIs |
|
Perform ANSI SQL queries on Customer Data Platform data | cdp_query_api |
Perform requests at any time | refresh_token, offline_access |
Metadata |
|