What Changed

The ASimAuthenticationSalesforceSC and vimAuthenticationSalesforceSC parsers have been updated from v0.1.0 to v0.2.0. The parsers previously queried only the legacy SalesforceServiceCloud_CL table. They now union across three tables: SalesforceServiceCloud_CL, SalesforceServiceCloudV2_CL, and SalesforceServiceCloudV3_CL.

The unifying ASimAuthentication (v0.2.15 to v0.2.16) and imAuthentication parsers have been updated to pass the pack parameter through to the Salesforce sub-parser – a call-site omission that previously caused the parameter to be silently ignored.

A coalesce fix was applied to the TargetUsername mapping to handle rows where the UserName column is absent (present in V2/V3 schema variants).

Custom table schema definitions for SalesforceServiceCloudV2_CL and SalesforceServiceCloudV3_CL have been added to the KQL validation test harness.

Parser Impact

  • Schema: ASIM Authentication (v0.1.3 to v0.1.4)
  • Tables normalised: SalesforceServiceCloud_CL (existing), SalesforceServiceCloudV2_CL (new), SalesforceServiceCloudV3_CL (new)
  • Gap closed: Deployments that installed the Salesforce Service Cloud connector via the updated CCF-based connectors (V2 or V3) were ingesting raw logs into SalesforceServiceCloudV2_CL or SalesforceServiceCloudV3_CL, but every ASIM-normalised detection and hunting query referencing imAuthentication or ASimAuthentication returned zero Salesforce rows – a complete authentication visibility blind spot for those deployments.
  • pack parameter fix: The missing pack=pack argument in the unifying parser call meant callers requesting packed output received unpacked results; this is now corrected.
  • TargetUsername fidelity: The coalesce on UserName prevents null propagation for rows where the column is absent in newer schema versions.
  • No field renames: Existing normalised field names are unchanged – detections relying on this parser do not require modification.

Affected Files

.script/tests/KqlvalidationsTests/CustomTables/SalesforceServiceCloudV2_CL.json
.script/tests/KqlvalidationsTests/CustomTables/SalesforceServiceCloudV3_CL.json
.script/tests/KqlvalidationsTests/CustomTables/SalesforceServiceCloud_CL.json
Parsers/ASimAuthentication/ARM/ASimAuthentication/ASimAuthentication.json
Parsers/ASimAuthentication/ARM/ASimAuthenticationSalesforceSC/ASimAuthenticationSalesforceSC.json
Parsers/ASimAuthentication/ARM/ASimAuthenticationSalesforceSC/README.md
Parsers/ASimAuthentication/ARM/imAuthentication/imAuthentication.json
Parsers/ASimAuthentication/ARM/vimAuthenticationSalesforceSC/README.md
Parsers/ASimAuthentication/ARM/vimAuthenticationSalesforceSC/vimAuthenticationSalesforceSC.json
Parsers/ASimAuthentication/CHANGELOG/ASimAuthentication.md
Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationSalesforceSC.md
Parsers/ASimAuthentication/CHANGELOG/imAuthentication.md
Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationSalesforceSC.md
Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml
Parsers/ASimAuthentication/Parsers/ASimAuthenticationSalesforceSC.yaml
Parsers/ASimAuthentication/Parsers/imAuthentication.yaml
Parsers/ASimAuthentication/Parsers/vimAuthenticationSalesforceSC.yaml
Parsers/ASimAuthentication/Tests/Salesforce_ASimAuthentication_DataTest.csv
Parsers/ASimAuthentication/Tests/Salesforce_Service Cloud_ASimAuthentication_DataTest.csv
Parsers/ASimAuthentication/Tests/Salesforce_Service Cloud_ASimAuthentication_SchemaTest.csv
Parsers/ASimAuthentication/Tests/Salesforce_Service Cloud_vimAuthentication_DataTest.csv
Parsers/ASimAuthentication/Tests/Salesforce_Service Cloud_vimAuthentication_SchemaTest.csv
Parsers/ASimAuthentication/Tests/Salesforce_vimAuthentication_DataTest.csv
Sample Data/ASIM/Salesforce_Service Cloud_Authentication_IngestedLogs.csv