# Salesforce ITSM

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FRGG1pPIkk5VYmbM6aGgp%2Fkeeper%2Bsalesforce.png?alt=media&#x26;token=a5e75bc9-da97-48e2-8c0a-f2106148e8f9" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
This integration is coming soon. ETA end of **February 2026**
{% endhint %}

## Overview

Salesforce managed package that automatically converts Keeper Security alerts into Service Cloud Cases for streamlined incident management.

When security events occur in your Keeper environment (such as failed logins, vault transfers, or BreachWatch alerts), the package automatically creates Salesforce Cases for your IT and security teams to investigate and resolve.

### Key Features

* **Guided Setup Wizard** - Step-by-step setup assistant with progress tracking and auto-detection
* **Automated Case Creation** - Security alerts from Keeper automatically create Cases in Salesforce
* **Flexible Field Mapping** - Map Keeper alert data to any Case field (standard or custom)
* **Priority Rules** - Configure priority rules based on event types and categories
* **Secure Authentication** - Token-based webhook authentication
* **Admin Configuration UI** - Easy-to-use configuration interface for admins

***

## Installation

### Prerequisites

Before installing, ensure you have:

* Salesforce Enterprise, Performance, Unlimited, or Developer Edition
* System Administrator profile or equivalent permissions
* An active Keeper Security Enterprise subscription

### Install the Package

1. Navigate to the AppExchange listing for **Keeper ITSM**
2. Click **Get It Now**
3. Select your Salesforce org (Production or Sandbox)
4. Choose **Install for Admins Only** (recommended)
5. Click **Install** and wait for confirmation

{% hint style="info" %}
Installation typically takes 2-5 minutes. You will receive an email when complete.
{% endhint %}

***

## What Gets Installed

The package automatically creates the following components in your org:

### Components Auto-Created on Install

<table><thead><tr><th width="226.3046875">Component</th><th>Description</th></tr></thead><tbody><tr><td><strong>Custom Fields on Case</strong></td><td>8 Keeper-specific fields for capturing alert data</td></tr><tr><td><strong>Custom Objects</strong></td><td><code>Keeper_Field_Mapping__c</code>, <code>Keeper_Priority_Mapping__c</code> for configuration</td></tr><tr><td><strong>Custom Settings</strong></td><td><code>Keeper_Webhook_Settings__c</code> for secure token storage</td></tr><tr><td><strong>Permission Sets</strong></td><td>Keeper ITSM Admin, Keeper ITSM User, Keeper Webhook User</td></tr><tr><td><strong>Apex Classes</strong></td><td>Webhook controller, incident service, mapping controllers</td></tr><tr><td><strong>Aura Component</strong></td><td>Configuration UI (<code>KeeperConfigApp</code>)</td></tr><tr><td><strong>Custom Tab</strong></td><td>Keeper ITSM Config</td></tr><tr><td><strong>Lightning App</strong></td><td>Keeper Security ITSM</td></tr><tr><td><strong>Page Layouts</strong></td><td>Case layouts with Keeper fields pre-configured</td></tr><tr><td><strong>Site Definition</strong></td><td>KeeperWebhook site for receiving external webhooks</td></tr><tr><td><strong>Site Guest Profile</strong></td><td>Configured with minimal permissions for webhook processing</td></tr></tbody></table>

### Custom Fields on Case

<table><thead><tr><th width="242.95703125">Field Label</th><th width="289.4765625">API Name</th><th>Type</th></tr></thead><tbody><tr><td>Keeper Alert Name</td><td><code>Keeper_Alert_Name__c</code></td><td>Text (255)</td></tr><tr><td>Keeper Event Type</td><td><code>Keeper_Event_Type__c</code></td><td>Text (255)</td></tr><tr><td>Keeper Username</td><td><code>Keeper_Username__c</code></td><td>Text (255)</td></tr><tr><td>Keeper Alert Timestamp</td><td><code>Keeper_Alert_Timestamp__c</code></td><td>Date/Time</td></tr><tr><td>Keeper IP Address</td><td><code>Keeper_IP_Address__c</code></td><td>Text (50)</td></tr><tr><td>Keeper Category</td><td><code>Keeper_Category__c</code></td><td>Text (100)</td></tr><tr><td>Keeper Alert Description</td><td><code>Keeper_Alert_Description__c</code></td><td>Long Text Area</td></tr><tr><td>Keeper Client Version</td><td><code>Keeper_Client_Version__c</code></td><td>Text (100)</td></tr></tbody></table>

### Permission Sets

<table><thead><tr><th width="249.94140625">Permission Set</th><th>Purpose</th></tr></thead><tbody><tr><td><strong>Keeper ITSM Admin</strong></td><td>Full access to configuration UI, field mappings, priority mappings</td></tr><tr><td><strong>Keeper ITSM User</strong></td><td>Read access to Keeper Case fields</td></tr><tr><td><strong>Keeper Webhook User</strong></td><td>Used by site guest user for webhook processing</td></tr></tbody></table>

***

## Post-Installation Setup

After the package is installed, complete the configuration using the **Guided Setup** wizard or follow the manual steps below.

{% hint style="success" %}
**Recommended:** Use the **Guided Setup** tab in the Keeper ITSM Config page. It provides step-by-step instructions with automatic progress tracking and will detect which steps are already complete.
{% endhint %}

### Using Guided Setup (Recommended)

1. Open the **App Launcher** (9-dot grid icon)
2. Search for and select **Keeper ITSM Config**
3. The **Guided Setup** tab opens by default, showing your setup progress
4. Follow the numbered steps - completed steps show a green checkmark
5. Click the action buttons to complete each step

The Guided Setup wizard automatically detects:

* Whether the Salesforce Site is active
* Whether an authentication token has been generated
* How many field mappings are configured
* How many priority rules are configured

#### Setup Steps

<table><thead><tr><th width="80.76171875">Step</th><th width="207.66796875">Name</th><th width="295.69921875">Description</th><th>Auto-Detected</th></tr></thead><tbody><tr><td>1</td><td>Assign Permission Sets</td><td>Grant non-admin users access to configuration (optional)</td><td>Yes</td></tr><tr><td>2</td><td>Activate Salesforce Site</td><td>Ensure the webhook endpoint is accessible</td><td>Yes</td></tr><tr><td>3</td><td>Generate Authentication Token</td><td>Create a secure token for webhook authentication</td><td>Yes</td></tr><tr><td>4</td><td>Configure Field Mappings</td><td>Map Keeper alert fields to Case fields (recommended)</td><td>Yes</td></tr><tr><td>5</td><td>Configure Priority Rules</td><td>Set Case priority based on event types (recommended)</td><td>Yes</td></tr><tr><td>6</td><td>Configure Keeper Admin Console</td><td>Add webhook URL in Keeper (external step)</td><td>No</td></tr><tr><td>7</td><td>Test Integration</td><td>Verify the integration by creating a test Case</td><td>Manual</td></tr></tbody></table>

#### Progress Tracking

* The progress ring shows the percentage of core steps completed (Steps 2-5)
* Completed steps display a green checkmark
* Pending steps show a numbered icon
* Optional steps are marked with an "Optional" badge

#### Testing from Guided Setup

Click the **Run Test** button in Step 7 to create a test Case directly from the wizard. This verifies that:

* The Salesforce Site is properly configured
* Field mappings are working correctly
* Priority rules are being applied

{% hint style="info" %}
The test creates an actual Case record with Origin "Keeper Security" that you can view and delete afterward.
{% endhint %}

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2Fr4Lg1iY84Ibyx4BLeNKe%2FScreenshot%202026-02-02%20at%204.30.50%E2%80%AFPM.png?alt=media&#x26;token=4cd18554-f626-4cc0-9299-a69df6c3c8c0" alt=""><figcaption><p>Progress ring showing 100% complete</p></figcaption></figure>

***

### Manual Setup Steps

If you prefer manual configuration, follow these steps:

#### Step 1: Assign Permission Set to Admins (Optional)

{% hint style="info" %}
**System Administrators** already have full access to the configuration page. This step is only needed if you want non-admin users to manage the Keeper ITSM configuration.
{% endhint %}

Assign the **Keeper ITSM Admin** permission set to users who need to configure the integration:

1. Go to **Setup** → **Permission Sets**
2. Click **Keeper ITSM Admin**
3. Click **Manage Assignments** → **Add Assignments**
4. Select the administrator users and click **Assign**

<div><figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2F5NRDN7afzGToHHJyBjl2%2FScreenshot%202026-02-02%20at%204.36.16%E2%80%AFPM.png?alt=media&#x26;token=c4c7891f-4ecf-4de9-ae6b-b596d5f39f0a" alt=""><figcaption></figcaption></figure> <figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FlJUMsLkHe1O9LPtrnMlZ%2FScreenshot%202026-02-02%20at%204.36.30%E2%80%AFPM.png?alt=media&#x26;token=2187f510-9952-450d-8c65-cacdc9c45849" alt=""><figcaption></figcaption></figure> <figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2Ffr4zToqcprGXC8L6vGFh%2FScreenshot%202026-02-02%20at%204.38.29%E2%80%AFPM.png?alt=media&#x26;token=eb17739d-cb82-4c37-a231-2ce1f1b389f8" alt=""><figcaption></figcaption></figure></div>

#### Step 2: Activate and Configure the Salesforce Site

The webhook endpoint requires an active Salesforce Site. Configure it as follows:

1. Go to **Setup** → **Sites**
2. Locate the **KeeperWebhook** site (or create one if not auto-created)
3. Click **Activate** if the site is not already active
4. Note the **Site URL** - you'll need this for the Keeper Admin Console

{% hint style="warning" %}
The Site URL varies by org. It typically follows this format: `https://[your-domain].my.salesforce-sites.com/keeper`
{% endhint %}

**Verify Site Guest User Permissions**

1. Go to **Setup** → **Sites** → **KeeperWebhook** → **Public Access Settings**
2. Verify the guest user profile has:
   * **Apex Class Access**: `KeeperWebhookController`, `KeeperIncidentService`, `KeeperTokenService`
   * **Object Permissions**: Create on Case, Read on `Keeper_Field_Mapping__c`, Read on `Keeper_Priority_Mapping__c`

#### Step 3: Generate Authentication Token

1. Open the **App Launcher** (9-dot grid icon)
2. Search for and select **Keeper ITSM Config**
3. On the **Webhook Setup** tab, click **Generate New Token**
4. Click **Reveal** to view the token, then **Copy** it

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FZdZZ7kMecAidJjIIRWSu%2FScreenshot%202026-02-02%20at%204.43.34%E2%80%AFPM.png?alt=media&#x26;token=f8826a8d-b853-45cd-b8a1-9ec437a5340b" alt=""><figcaption></figcaption></figure>

{% hint style="danger" %}
Store the token securely. You'll need it to configure the Keeper Admin Console.
{% endhint %}

#### Step 4: Configure Keeper Admin Console

1. Log in to the [Keeper Admin Console](https://keepersecurity.com/console/#login)
2. Navigate to **Reporting & Alerts**
3. Go to **Alerts** → **Add Alert** and select the alert types to monitor
4. Go to **Alerts** → **Add Recipient**
5. Select **Webhook** as the recipient type
6. Enter the full URL with token:

```
https://[your-site-url]/services/apexrest/keeper/webhook?token=YOUR_TOKEN_HERE
```

7. Save the configuration

#### Optional: Assign Page Layout

If you want to use the package's pre-configured Case layout with Keeper fields:

1. Go to **Setup** → **Object Manager** → **Case** → **Page Layouts**
2. Click **Page Layout Assignment**
3. Assign the **Case Layout** (with Keeper fields) to relevant profiles
4. Click **Save**

{% hint style="info" %}
Alternatively, add the Keeper custom fields to your existing Case page layouts manually.
{% endhint %}

***

## Configuration

Access the configuration page by opening the **App Launcher** and searching for **Keeper ITSM Config**. The page has four tabs: Guided Setup, Webhook Setup, Field Mapping, and Priority Mapping.

{% hint style="info" %}
You must have the **Keeper ITSM Admin** permission set or **System Administrator** profile to access the configuration page.
{% endhint %}

### Webhook Setup

The Webhook Setup tab provides the URL and authentication token needed to configure Keeper to send alerts to Salesforce.

#### Webhook URL

The webhook URL is displayed on the configuration page. Copy this URL to use in the Keeper Admin Console.

**URL Format:**

```
https://[your-domain].my.salesforce-sites.com/keeper/services/apexrest/keeper/webhook
```

#### Authentication Token

* Click **Reveal** to display the full token
* Click **Copy** to copy the token to clipboard
* Click **Generate New Token** to create a new token

{% hint style="danger" %}
Generating a new token immediately invalidates the previous token. Update the Keeper Admin Console with the new token right away to avoid service interruption.
{% endhint %}

#### Full Webhook URL with Token

Append the token as a query parameter:

```
https://[your-site-url]/services/apexrest/keeper/webhook?token=YOUR_TOKEN_HERE
```

### Field Mapping

Field Mapping allows you to control which Keeper alert data populates which Salesforce Case fields.

#### Available Keeper Fields

<table><thead><tr><th width="198.37890625">Keeper Field</th><th width="211.28125">API Name</th><th>Description</th></tr></thead><tbody><tr><td>Alert Name</td><td><code>alert_name</code></td><td>Name of the alert rule that triggered</td></tr><tr><td>Audit Event Type</td><td><code>audit_event</code></td><td>Event type code (e.g., <code>login_failure</code>)</td></tr><tr><td>Username</td><td><code>username</code></td><td>User who triggered the event</td></tr><tr><td>Description</td><td><code>description</code></td><td>Alert description text</td></tr><tr><td>Timestamp</td><td><code>timestamp</code></td><td>When the event occurred (ISO 8601)</td></tr><tr><td>Remote IP Address</td><td><code>remote_address</code></td><td>IP address of the request origin</td></tr><tr><td>Category</td><td><code>category</code></td><td>Event category</td></tr><tr><td>Client Version</td><td><code>client_version</code></td><td>Keeper client version</td></tr></tbody></table>

#### Adding a Field Mapping

1. Navigate to the **Field Mapping** tab
2. Select a **Keeper Field** from the dropdown
3. Select a **Salesforce Case Field** from the dropdown
4. Click **Add Mapping**

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FHjHSZuD6oxK121p5s9V1%2FScreenshot%202026-02-02%20at%204.45.45%E2%80%AFPM.png?alt=media&#x26;token=2a3da9c4-361d-4333-b4f5-78ecebf1c702" alt=""><figcaption></figcaption></figure>

{% hint style="warning" %}
Each Salesforce field can only be mapped to one Keeper field. Adding a duplicate mapping will replace the existing one.
{% endhint %}

#### Recommended Mappings

| Keeper Field      | Recommended Case Field   |
| ----------------- | ------------------------ |
| Alert Name        | Keeper Alert Name        |
| Audit Event Type  | Keeper Event Type        |
| Username          | Keeper Username          |
| Timestamp         | Keeper Alert Timestamp   |
| Remote IP Address | Keeper IP Address        |
| Category          | Keeper Category          |
| Description       | Keeper Alert Description |
| Client Version    | Keeper Client Version    |

#### Managing Mappings

* **Toggle Active/Inactive** - Use the toggle switch to enable or disable a mapping
* **Search** - Use the search box to filter mappings
* **Delete** - Click the delete icon to remove a mapping
* **Pagination** - Navigate through mappings using the page controls

#### Default Behavior (No Mappings Configured)

If no field mappings are configured, the package applies these defaults:

<table><thead><tr><th width="194.83984375">Field</th><th>Default Value</th></tr></thead><tbody><tr><td>Subject</td><td><code>[Alert Name]: [Event Type]</code></td></tr><tr><td>Description</td><td>Full alert details in text format</td></tr><tr><td>Origin</td><td><code>Keeper Security</code></td></tr><tr><td>Status</td><td><code>New</code></td></tr><tr><td>Priority</td><td>Determined by Priority Mapping rules (default: Low)</td></tr></tbody></table>

### Priority Mapping

Priority Mapping allows you to automatically set Case priority based on the type of security event.

#### How Priority Matching Works

When a Keeper alert arrives, the system:

1. Checks for an **exact match** with configured event patterns
2. If no exact match, checks for **partial/contains matches**
3. If no match found, assigns default priority: **Low**

#### Adding Priority Rules

**Method 1: Category + Event Selection**

1. Navigate to the **Priority Mapping** tab
2. Select a **Category** from the dropdown
3. Optionally select a specific **Event** (leave empty to map ALL events in that category)
4. Select the **Priority**
5. Click **Add Rule**

{% hint style="info" %}
Leave the Event field empty to map ALL events in the selected category at once. This is useful for quickly setting up priority rules for entire categories.
{% endhint %}

**Method 2: Quick Add Buttons**

Use the Quick Add buttons to add common security rules:

<table><thead><tr><th width="234.30078125">Button</th><th>What it Creates</th></tr></thead><tbody><tr><td><strong>Security → High</strong></td><td>BreachWatch alerts, vault transfers, user deletions, 2FA failures, KeeperAI critical/high risks</td></tr><tr><td><strong>Login Failures → High</strong></td><td>Failed logins, failed console logins, IP blocks, auth failures</td></tr><tr><td><strong>Role Changes → Medium</strong></td><td>Role additions/removals, team changes, permission changes, user locks</td></tr><tr><td><strong>Normal Ops → Low</strong></td><td>Normal logins, record operations, password copies, exports/imports</td></tr></tbody></table>

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FZ8g552pMDkJwzakvZKCp%2FScreenshot%202026-02-02%20at%204.45.54%E2%80%AFPM.png?alt=media&#x26;token=ca96cb18-a0e4-42f0-a4e5-af2631a5ff31" alt=""><figcaption></figcaption></figure>

#### Event Categories Reference

The package supports 17 event categories with over 300 events from Keeper Security.

For the complete list of event types and their descriptions, refer to [Reporting, Alerts & SIEM](https://docs.keeper.io/enterprise-guide/event-reporting#event-descriptions)

{% hint style="info" %}
The Salesforce ITSM package includes all event types from Keeper's Event Reporting documentation as of the current package version.
{% endhint %}

#### Recommended Priority Configuration

<table><thead><tr><th width="531.2734375">Event Types</th><th>Recommended Priority</th></tr></thead><tbody><tr><td>Vault transfers, Account deletions, 2FA failures, IP blocks</td><td><strong>High</strong></td></tr><tr><td>Login failures, BreachWatch detections, KeeperAI alerts</td><td><strong>High</strong></td></tr><tr><td>Role changes, Permission changes, User locks</td><td><strong>Medium</strong></td></tr><tr><td>Record views, Password copies, Normal logins</td><td><strong>Low</strong></td></tr></tbody></table>

***

## Testing the Integration

### Option 1: Use the Built-in Test (Recommended)

The easiest way to test the integration:

1. Go to **Keeper ITSM Config** → **Guided Setup** tab
2. Scroll to **Step 7: Test Integration**
3. Click **Run Test**
4. If successful, a test Case will be created and a link will appear

This creates a Case with:

* Subject: "Guided Setup Test Alert: test\_event"
* Origin: "Keeper Security"
* All configured field mappings applied

### Option 2: Send a Test Webhook via cURL/Postman

Use cURL or Postman to send a test webhook:

```bash
curl -X POST \
  'https://[your-site-url]/services/apexrest/keeper/webhook?token=YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
    "alert_name": "Test Alert",
    "audit_event": "login_failure",
    "username": "test.user@example.com",
    "description": "Test alert from manual trigger",
    "timestamp": "2025-01-30T10:30:00Z",
    "remote_address": "192.168.1.100",
    "category": "Login",
    "client_version": "16.10.0"
  }'
```

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2Fz9Cpa5QQsXqnnbE8d7np%2FScreenshot%202026-02-02%20at%204.52.03%E2%80%AFPM.png?alt=media&#x26;token=b3b6d8ae-3eb0-458a-a551-306a7eea03ed" alt=""><figcaption></figcaption></figure>

### Expected Responses

**Success (HTTP 200):**

```json
{
  "success": true,
  "caseId": "500XXXXXXXXXXXX"
}
```

**Authentication Error (HTTP 401):**

```json
{
  "success": false,
  "errorCode": "ERR_001",
  "message": "Unauthorized"
}
```

**Invalid Payload (HTTP 400):**

```json
{
  "success": false,
  "errorCode": "ERR_002",
  "message": "Invalid request format"
}
```

**Processing Error (HTTP 500):**

```json
{
  "success": false,
  "errorCode": "ERR_003",
  "message": "An error occurred processing the request"
}
```

***

## Troubleshooting

### Cases Not Being Created

<table><thead><tr><th width="216.70703125">Issue</th><th>Solution</th></tr></thead><tbody><tr><td>Webhook URL incorrect</td><td>Verify the full URL includes <code>/services/apexrest/keeper/webhook</code></td></tr><tr><td>Token invalid</td><td>Generate a new token and update Keeper Admin Console</td></tr><tr><td>Site not active</td><td>Go to Setup → Sites and activate the KeeperWebhook site</td></tr><tr><td>Guest user permissions</td><td>Verify the site guest profile has access to required Apex classes</td></tr></tbody></table>

### "Access Denied" on Configuration Page

**Cause:** User doesn't have the required permission set.

**Solution:**

1. Go to **Setup** → **Permission Sets** → **Keeper ITSM Admin**
2. Click **Manage Assignments** → **Add Assignment**
3. Select the user and click **Assign**

### Field Data Not Appearing on Cases

<table><thead><tr><th width="206.46875">Issue</th><th>Solution</th></tr></thead><tbody><tr><td>Mapping not active</td><td>Ensure the toggle is ON for the mapping</td></tr><tr><td>Field not in allowed list</td><td>Only whitelisted fields can be mapped (see <code>KeeperIncidentService</code>)</td></tr><tr><td>FLS permissions</td><td>Verify the guest user profile has create permission on the field</td></tr></tbody></table>

### Incorrect Priority Being Assigned

**Priority matching order:**

1. Exact match rules are evaluated first
2. Partial/contains matches are evaluated second
3. Default priority is **Low** if no rules match

**Tip:** Create specific event rules before broad category rules.

### "Closed" Status Not Showing on Cases

**Cause:** By default, Salesforce hides closed statuses from the Case Status picklist to prevent accidental closure.

**Solution:**

1. Go to **Setup** → **Support Settings**
2. Find the setting **"Show Closed Statuses in Case Status Field"**
3. Check the box to enable it
4. Click **Save**

{% hint style="info" %}
This is a Salesforce org-wide setting that affects all Cases, not just those created by Keeper ITSM.
{% endhint %}

***

## Security Considerations

### Token Security

* Tokens are generated using cryptographically secure AES-128 random generation
* Tokens are stored in protected custom settings (not visible in standard queries)
* Regenerate tokens periodically as a security best practice
* Never share tokens in unsecured channels

### Data Security

* All webhook requests require valid token authentication
* Error messages are sanitized to prevent information disclosure
* CRUD/FLS checks are enforced on all database operations
* Field mapping uses a whitelist approach for allowed fields

### Audit Trail

* All webhook requests are logged in Salesforce debug logs
* Cases created via webhook have `Origin = Keeper Security` for identification
* Failed authentication attempts are logged for security review

### Guest User Security

The site guest user profile is configured with minimal permissions:

* **Apex Access**: Only webhook-related classes
* **Object Access**: Create-only on Case, Read-only on mapping objects
* **Field Access**: Limited to required Case fields

***

## FAQ

**Q: Can I use this with Salesforce sandbox?**

A: Yes, install the package in sandbox for testing. Use separate tokens for sandbox and production environments.

**Q: How do I upgrade to a new package version?**

A: Install the new version from AppExchange. Your configurations (mappings, tokens) are preserved during upgrades.

**Q: What Keeper events can trigger alerts?**

A: Any event type configured in Keeper Admin Console's Reporting & Alerts section.

**Q: Is the webhook endpoint secure?**

A: Yes. All requests require a valid authentication token. The endpoint uses HTTPS, and error messages don't expose internal system details.

**Q: Can I customize the Case Subject format?**

A: Currently, the default format is `[Alert Name]: [Event Type]`. Map the `alert_name` or `audit_event` fields to the Subject field for custom behavior.

**Q: What happens if the token is compromised?**

A: Immediately generate a new token from the Webhook Setup tab. The old token is invalidated instantly. Update the Keeper Admin Console with the new token.