0

I am using QRADAR SIEM solution to collect Salesforce events. We have some troubles to get that solution working properly as we have a huge of "ApexCallout" events. As we don't need such events into the SIEM solution, we would like to stop collect them. Here are the different solution:

#1-Modify the QRadar agent collector in order to stop collect Apex Event Logs files. ==> This solution would take too much time to get developped.

#2-Restrict the access to those APex log files from the user profile (or something else). ==> Is it feasibIe? I didn't find how I can do this.

#3-Stop generate such events log files ==> Is it feasible? I didn't find how I can do this.

Do you know how can I do that ? Any other idea ?

Thanks

Improve this question

1 Answer 1

Reset to default
0

The EventLogFile is a single object, so the user either has access or not, and the logs are always generated.

The best option is to simply update the API call, by adding the security event types that you want to include (and exclude the performance ones you don't want). See example here: https://trailhead.salesforce.com/en/content/learn/modules/event_monitoring/event_monitoring_query

Otherwise you could also ask QRadar for help - their integration ideally shouldn't blindly pull into non-contextual data.

Improve this answer
1
  • Thanks for these information. Is it possible to disable specific events to avoid them generating logs into the EventLogFile object ?
    – zied
    Commented Oct 29, 2020 at 8:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .