Downloading the Salesforce audit trail file

To collect Salesforce Security Auditing events, you must download the Salesforce audit trail file to a remote host that QRadar can access.

About this task

You must use this procedure each time that you want to import an updated set of audit data into QRadar. When you download the audit trail file, you can overwrite the previous audit trail CSV file. When QRadar retrieves data from the audit trail file, QRadar processes only audit records that were not imported before.

Procedure

  1. Log in to your Salesforce Security Auditing server.
  2. Go to the Setup section.
  3. Click Security Controls.
  4. Click View Setup Audit Trail.
  5. Click Download setup audit trail for last six months (Excel.csv file).
  6. Copy the downloaded file to a location that QRadar can reach by using Log File Protocol.