Configuring the Salesforce External Client to communicate with QRadar

To enable communication between QRadar and Salesforce, configure an External Client App in the Salesforce console and collect the authentication details generated by the application. These details are required when configuring the QRadar log source.

1. Configure a Salesforce External Client App for Client Credential Flow.
   1. Log in to your Salesforce Security Monitoring server.
   2. Go to Setup > App Manager > New External Client App button.
   3. Provide the following information such as External Client App name, API name, contact email address, and other required fields.
   4. Select Enable OAuth Settings and enable OAuth option.
   5. Under App Settings, configure the Callback URL. Enter a URL where users can be redirected for more information about the application. For example: https://login.salesforce.com/
      https://login.salesforce.com/
   6. From the Selected OAuth Scopes list, select Manage user data via APIs (api)
   7. Configure any remaining optional parameters as required
   8. Under Flow Enablement, select Enable Client Credentials Flow.
   9. Click Save/Create to create the External Client App
2. Configure OAuth policies and Run As (Username) for the Salesforce External Client App.
   1. Go to Setup > External Client App Manager.
   2. Open the previously created External Client App.
   3. Click the Policies tab, then click Edit.
   4. Under App policies, select OAuth.
   5. From the Entitlement Management Settings window, select the Enable Entitlement Management check box.
   6. Under OAuth Policies, set Permitted Users to All users can self-authorize.
   7. Under OAuth Flows and External Client App Enhancements, select Enable Client Credentials Flow.
   8. In the Run As (Username) field, select the Salesforce user that the Client Credentials Flow will use.
      In some Salesforce UI versions, this field is displayed as Execution User.
   9. Configure any remaining optional parameters as required.
   10. Click Save.