Issues with ingesting Salesforce logs into SecOps

Hey all,

Has anyone faced issues ingesting Salesforce logs into Google SecOps using the OAuth JWT grant method?

We’re currently seeing authentication failures when configuring the feed using JWT (all required credentials provided as per Google documentation).

When switching to OAuth Password Grant, the configuration fails with:

No such column 'Interval' on entity 'EventLogFile'

From our research, the Interval field appears to require Salesforce Shield / Event Monitoring, but the customer only has Salesforce Enterprise Edition. The Google documentation mentions Enterprise and above should be sufficient.

Just checking:

• Is Shield/Event Monitoring mandatory for this integration?

• Has anyone successfully used JWT grant without Shield?

• Any common causes for JWT authentication failure in this setup?

Appreciate any insights 🙏

Thanks!