Pull data from the ServiceNow API

Overview

Get a list of Salesforce query events through the Salesforce API using the HTTP Pull Listener.

HTTP Pull Listener configuration

In Falcon Onum, go to the Listeners area and click New Listener > HTTP Pull. Give a name to your new Listener and enter the following data:

Parameters

Add the following parameter:

• Name - instanceUrl

• Value - Enter your Salesforce instance URL.

• Name - apiVersion

• Value - Enter your Salesforce API version.

Secrets

You must define these credentials in Onum:

• clientId will reference your Salesforce client ID.

• clientSecret will reference your Salesforce client secret.

• username will reference your Salesforce username.

• password will reference your Salesforce password.

To do it, click Add element and enter a Name for the secret (in this case, clientId). Then, click the Value field and select New secret to create a new one:

• Give the secret a Name.

• Turn off the Expiration date option.

• Click Add new value and paste the secret corresponding to the value.

• Click Save.

You can now select the secret you just created in the Value field list. Repeat the process for the rest of secrets.

Learn more about secrets in Onum in this article.

Setup

After entering the required parameters and secrets, you can choose to manually enter the rest of configuration fields, or simply paste the given YAML:

Config as YAML

Toggle ON the Config as YAML option to enable a free text field where you can paste the following YAML:

withTemporalWindow: true
temporalWindow:
  duration: 5m
  offset: 5m
  tz: UTC
  format: RFC3339
withAuthentication: true
authentication:
  type: "token"
  token:
    request:
      method: "POST"
      url: "${parameters.instanceUrl}/services/oauth2/token"
      bodyType: "urlEncoded"
      bodyParams:
        - name: "grant_type"
          value: "password"
        - name: "client_id"
          value: "${secrets.clientId}"
        - name: "client_secret"
          value: "${secrets.clientSecret}"
        - name: "username"
          value: "${secrets.username}"
        - name: "password"
          value: "${secrets.password}"
      headers:
        - name: "Content-Type"
          value: "application/x-www-form-urlencoded"
    tokenPath: ".access_token"
    authInjection:
      in: "header"
      name: "Authorization"
      prefix: "Bearer "
withEnumerationPhase: true
enumerationPhase:
  paginationType: cursor
  cursorSelector: ".nextRecordsUrl"
  initialRequest:
    responseType: json
    method: GET
    url: ${parameters.instanceUrl}/services/data/${parameters.apiVersion}/query
    headers:
      - name: Accept
        value: application/json
      - name: Content-Type
        value: application/json
    queryParams:
      - name: "q"
        value: "SELECT Id, EventType, LogDate, CreatedDate FROM EventLogFile WHERE LogDate >= ${temporalWindow.from} AND LogDate < ${temporalWindow.to} ORDER BY LogDate"
  nextRequest:
    responseType: json
    method: GET
    url: ${parameters.instanceUrl}/services/data/${parameters.apiVersion}/query/${pagination.cursor}
    headers:
      - name: Accept
        value: application/json
      - name: Content-Type
        value: application/json
  output:
    select: ".records"
    filter: "."
    map: "."
    outputMode: element
collectionPhase:
  variables:
    - name: "eventLogFileId"
      source: "input"
      expression: ".Id"
    - name: "eventType"
      source: "input"
      expression: ".EventType"
    - name: "logDate"
      source: "input"
      expression: ".LogDate"
  paginationType: none
  request:
    method: "GET"
    url: "${parameters.instanceUrl}/services/data/${parameters.apiVersion}/sobjects/EventLogFile/${inputs.eventLogFileId}/LogFile"
    headers:
      - name: "Accept"
        value: "text/csv"
      - name: "Accept-Encoding"
        value: "gzip"
  output:
    select: "."
    map: "{\"SFDCLogId\": ${inputs.eventLogFileId}, \"SFDCLogType\": ${inputs.eventType}, \"SFDCLogDate\": ${inputs.logDate}, \"content\": .}"
    outputMode: "element"

Manually configure

When you're done, click Create labels to move on to the next step and define the required Labels if needed.