Real-Time Event Monitoring for Salesforce Cloud (Configure)

⚙️ Configure Salesforce Real-Time Event Monitoring

GermainUX subscribes to Salesforce Real-Time Event Monitoring streams and converts supported Salesforce events into KPIs for security, compliance, operational, and user-activity analysis.

Real-Time Event Monitoring helps teams:

The monitoring is performed by the GermainUX Engine.

✅ What Can Be Monitored

Available events depend on the Salesforce organization’s edition, licenses, enabled features, event topics, and integration-user permissions.

🔐 Authentication and Session Security

GermainUX can process available events related to:

📁 Sensitive Data Access

Available events can help detect when users:

🛰️ API Activity

GermainUX can monitor available events involving:

📊 Reports and Exports

Available report events can help identify when users:

✨ Records and Lightning Activity

Available events can include:

🛠️ Permissions and Administration

GermainUX can monitor supported events involving:

For broader scheduled configuration tracking, also use Salesforce Audit Monitoring.

📱 Salesforce Mobile Activity

When Salesforce exposes the applicable events, GermainUX can monitor supported mobile activity such as:

Limits and Operational Errors

GermainUX can detect supported events associated with Salesforce execution problems, such as exceeding the concurrent long-running Apex-request limit.

📋 Prerequisites

Before configuring Real-Time Event Monitoring, confirm that:

▶️ Enable Real-Time Event Monitoring

Real-Time Event Monitoring is enabled automatically when Salesforce monitoring is deployed through the Salesforce Application wizard.

To deploy it:

1. Open GermainUX Workspace.

2. Open the left navigation menu.

3. Select Wizards.

4. Select Salesforce Application.

5. Choose the GermainUX Engine that will receive the events.

6. Enter the Salesforce OAuth and organization settings.

7. Complete the wizard.

8. Confirm that the Salesforce event-monitoring component is enabled.

The component is identified as:

Salesforce Event Monitoring

🔁 How Real-Time Collection Differs From Scheduled Monitoring

Real-Time Event Monitoring maintains event-stream subscriptions instead of periodically polling Salesforce on an hourly or daily schedule.

Real-time means that GermainUX processes the event shortly after it becomes available from Salesforce. It does not guarantee zero latency; delivery depends on Salesforce event publication, network connectivity, and processing.

⚙️ Configure Event Topics

The Salesforce Event Monitor subscribes to a configured list of topics.

Enable only the topics required for the intended use cases because each topic can affect:

Typical categories include:

The exact topic names depend on the Salesforce services and GermainUX version.

⛔ Disable an Event Topic

To stop collecting an individual topic while leaving the monitor active:

1. Open GermainUX Workspace.

2. Open the left navigation menu.

3. Navigate to:

   System → Engine → Component Types

4. Search for:

   Name = Salesforce Event Monitor
   

5. Open the component type.

6. Locate Topics.

7. Remove the topic that should no longer be monitored.

8. Save the configuration.

9. Restart or refresh the applicable component if required.

10. Confirm that events from the removed topic no longer arrive.

Record the previous topic list before editing it so the configuration can be restored if needed.

➕ Add or Restore an Event Topic

To add or restore a topic:

1. Confirm that the Salesforce organization exposes the topic.

2. Confirm that the integration user can subscribe to it.

3. Open the Salesforce Event Monitor component type.

4. Add the exact supported topic name to Topics.

5. Save the configuration.

6. Restart or refresh the component if required.

7. Generate a controlled test event.

8. Confirm that it appears in GermainUX.

Do not invent or approximate topic names. Use only event topics supported by both Salesforce and the installed GermainUX version.

⏹️ Disable Real-Time Event Monitoring

To stop all Salesforce real-time event collection:

1. Open GermainUX Workspace.

2. Open the left navigation menu.

3. Select Germain.

4. Open the State tab.

5. Search for:

   Name = Salesforce Event Monitoring
   

6. Locate the component associated with the intended Salesforce organization.

7. Turn off the toggle in the Enabled column.

8. Save the change if prompted.

Previously collected events remain available according to the configured retention policy.

🔁 Re-enable Monitoring

To resume all configured event subscriptions:

1. Return to Germain → State.

2. Search for Salesforce Event Monitoring.

3. Turn on the Enabled toggle.

4. Confirm that the OAuth connection is valid.

5. Confirm the configured topic list.

6. Save the configuration.

7. Verify that new events arrive.

👀 View Real-Time Events

Open:

GermainUX Workspace → Dashboards → All → Salesforce RT Events

The dashboard can provide:

Select an event or KPI to drill through to its attributes and related evidence.

Unknown Attachment

📊 Salesforce Real-Time Event KPIs

See Salesforce Real-Time Event KPIs.

Depending on the event type, useful measures include:

Useful pivots may include:

🔔 Configure Alerts

Real-Time Event Monitoring is particularly valuable when events require immediate review.

🛡️ Security Alerts

Examples include:

🔧 Operational Alerts

Examples include:

Configure thresholds and categorization to avoid sending an alert for every routine event.

🔗 Correlate Events With Other Evidence

Real-Time Events become more useful when correlated with:

For example:

1. A report-export event identifies a user exporting sensitive data.

2. Browser monitoring identifies the Salesforce session.

3. Session Replay shows the navigation and actions leading to the export.

4. Audit data reveals a recent permission change.

5. GermainUX alerts the security team with the related evidence.

Correlation depends on the identifiers available across the event sources.

✅ Validate Real-Time Event Monitoring

Test each required topic separately.

1. Confirm that Salesforce Event Monitoring is enabled.

2. Confirm that the Engine is connected to Salesforce.

3. Verify the OAuth authorization and permissions.

4. Review the configured topics.

5. Generate a safe test event in a non-production environment.

6. Open Salesforce RT Events.

7. Confirm that the event appears.

8. Verify its event type, user, timestamp, organization, and result.

9. Test the applicable categorization.

10. Confirm that any alert is triggered and routed correctly.

Use controlled tests that comply with organizational security policies. Do not simulate an actual credential attack or unauthorized access.

❌ No Real-Time Events Appear

If events are missing:

1. Confirm that the Salesforce organization supports the event topic.

2. Verify that the required Salesforce feature or license is active.

3. Confirm that the integration user can subscribe to the topic.

4. Verify the Salesforce OAuth connection.

5. Check that Salesforce Event Monitoring is enabled.

6. Confirm that the topic remains in the configured Topics list.

7. Verify that the GermainUX Engine is running.

8. Check Engine connectivity to Salesforce.

9. Review Engine logs for authentication, subscription, network, and parsing errors.

10. Confirm that a matching event occurred during the selected time range.

11. Review dashboard organization, environment, and event-type filters.

12. Check applicable Salesforce event-delivery entitlements and limits.

❓ Only Some Event Types Appear

If some topics work and others do not:

• Verify Salesforce support and licensing for each missing topic.

• Check permissions for the integration user.

• Confirm the exact topic name.

• Verify the topic is present in Topics.

• Generate a known event of that type.

• Review Engine logs for topic-specific subscription errors.

• Confirm that the dashboard includes the corresponding KPI.

⏱️ Event Delivery Stops

If events appeared previously but stop arriving:

1. Confirm that the Engine is running.

2. Verify network connectivity.

3. Check whether the OAuth token expired or was revoked.

4. Confirm that the Connected App remains authorized.

5. Review subscription and reconnection errors.

6. Confirm that Salesforce still exposes the topic.

7. Check Salesforce service status.

8. Validate with a controlled test event.

9. Restart the monitor if required.

Configure a health alert for interrupted or stale event streams when continuous collection is critical.

💾 Data Volume and Retention

Real-time event streams can generate substantial data.

Before enabling many topics:

• Estimate expected event volume.

• Enable only required topics.

• Configure appropriate retention.

• Monitor Salesforce delivery entitlements.

• Monitor GermainUX ingestion and storage.

• Categorize repetitive events.

• Exclude non-actionable data.

• Review high-volume topics after deployment.

🔒 Security and Privacy

Real-time events can contain sensitive security and activity information, including:

Before production enablement:

• Use a dedicated least-privilege integration account.

• Restrict access to event dashboards and details.

• Mask, anonymize, or exclude sensitive fields.

• Never retain credentials, secrets, OAuth tokens, or reusable session identifiers.

• Apply appropriate retention.

• Review event use cases with Salesforce, security, privacy, and compliance owners.

📚 Related Documentation

ℹ️ Get More Information

GermainUX can help determine which monitoring, analytics and automation capabilities are appropriate for your Salesforce CRM environment.

Contact GermainUX Support.