Integrating Salesforce with Reco
Salesforce integration allows Reco to provide visibility and detection of abnormal activities on Salesforce objects and assets. With Reco's business context, you can rest assured that your sales and marketing operations are protected and secure.
Although not mandatory, Salesforce Shield is a subscription service that is required for generating the event logs. This will allow Reco to display useful insights about the activity in your Salesforce account, beyond just objects and permissions.
Prerequisites
A Reco user with an Admin Role
For Salesforce Shield customers
Ensure you have the right permissions as stated in "Enable Access to Real-Time Event Monitoring".
Namely, the user who is intended to authorize Reco must have at least the following permissions:View Real-Time Event Monitoring DataView Setup and ConfigurationView Event Log FilesView Event Log Object DataAPI Anomaly Event Stores(View All)Guest User Anomaly Event Stores(View All)Report Anomaly Event Stores(View All)Session Hijacking Event Stores(View All)
To enable this permission:
Login to Salesforce, and click on the Settings Icon on the upper-right side of the screen
At the left-side menu, under "ADMINISTRATION" -> "Users" -> Click on "Profiles".
Locate the profile of the authorizing user in the list and click on "Edit"
Search inside the page and enable the following permissions:
View Real-Time Event Monitoring DataView Setup and ConfigurationView Event Log FilesView Event Log Object DataAPI Anomaly Event Stores(View All)Guest User Anomaly Event Stores(View All)Report Anomaly Event Stores(View All)Session Hijacking Event Stores(View All)
Scroll to the bottom and click on "Save".
Enable Event Monitoring
Login to Salesforce, and click on the Settings Icon on the upper-right side of the screen
At the left-side menu, under "Settings" -> "Security" -> Expand "Event Monitoring" -> Click on "Event Monitoring Settings"
Enable “View event log data in Analytics apps”
Disable “Delete event monitoring data”
At the left-side menu, under "Platform Tools", expand "Events" -> Click on “Event Manager"
Enable streaming and storing for each event, where applicable
Configure Service Account
Log in to login.salesforce.com.
In the left navigation bar, go to Administration > Users > Profiles.
Clone a system administrator user profile. Ensure that the user profile has an active “Salesforce” license. In this example, click Clone beside the System Administrator.
On the Clone Profile page, enter a profile name and make sure the User License shows Salesforce.
Click Save.
After creating the custom profile, click Edit to modify the custom profile.
You must directly assign the permissions to the profile. Do not add the permissions through permission sets. Scroll down to the Administrative Permissions section of the custom profile.
Keep the default permissions as they are and enable the following permissions:
API Enabled
View All Data
View All Users
Keep the default permissions as they are and disable the following permissions:
Administrative Permissions -> uncheck Modify All Data, Manage IP Addresses.
General User Permissions -> uncheck Modify Data Classification.
Standard Object Permissions -> uncheck Modify All permission.
Custom Object Permissions -> uncheck Modify All permission.
Click Save.
In the left navigation bar, go to Administration > Users > Users.
Click Edit to modify an existing user, or New User to define a new user.
In the User Edit > General Information section, set the User License as Salesforce.
In the User Edit > General Information section, set the Profile created in step 4.
Click on Save.
Trusted IP Range
Reco recommends allowing a pool of Reco public IP addresses in Salesforce. This will ensure that Salesforce and Reco exchange events and notifications. To allow the IP addresses:
Log in to login.salesforce.com.
In the left navigation bar, go to Settings > Security > Network Access.
Click New beside Trusted IP Ranges.
In the Trusted IP Range Edit page, specify the Start IP Address and End IP Address.
Click Save.
To get a pool of Reco public IP addresses, talk with Reco Support.
Integrate Salesforce with Reco
Login to the Reco Platform
Click on "Configurations" then click on "Integrations"
Locate the "Salesforce" object and click on "Add Integration"
You will then be redirected to your Salesforce tenant consent page, Click on "Allow"
You will be then redirected back to the Reco platform
Click on "Configurations" then click on "Integrations"
Locate the "Salesforce" object and click on "Configure"
Click on "Save"
If the integration was successful, the Slack Notification Integration status will become "Active"
Grant Failure Due to Login IP Range
The grant of access may fail if the Salesforce username has any Login IP Ranges configured in Salesforce. Log in to your Salesforce account and verify if the user profile associated with the username has Login IP Ranges configured. If configured, follow the procedure below to ensure the grant goes through successfully.
Log in to login.salesforce.com.
On the top right, click Setup > Setup.
On the left navigation pane, search for Connected Apps > Connected Apps OAuth Usage.
Beside the Reco Introspection for Salesforce app, click Install.
A new window opens. Click Install.
On the Reco Introspection for Salesforce Connected app page, click Edit Policies.
Under OAuth Policies, set IP Relaxation to Relax IP restrictions.
Click Save.
What do we ingest exactly?
Permission | API / Object |
Access Analytics REST API Charts Geodata resources | eclair_api |
Access Analytics REST API resources | wave_api |
Access Connect REST API resources | chatter_api |
Access the identity URL service | id, profile, email, address, phone |
Access unique user identifiers | OpenID |
Manage user data via APIs |
|
Perform ANSI SQL queries on Customer Data Platform data | cdp_query_api |
Perform requests at any time | refresh_token, offline_access |
Metadata |
|