What Changed

The Salesforce Service Cloud CCF data connector (v3.4.1) adds SECURE_CONNECTION_START as a new column in two places:

  1. DCR stream schema (SalesforceServiceCloud_DCR.json): A new SECURE_CONNECTION_START field of type string is added to the stream input schema, immediately after the existing SECURE_CONNECT_START field.
  2. DCR transformKql (SalesforceServiceCloud_DCR.json): The projection now maps SecureConnectionStart=SECURE_CONNECTION_START, routing the raw field into the SalesforceServiceCloudV3_CL destination table.
  3. Table schema (SalesforceServiceCloud_Tables.json): The SalesforceServiceCloudV3_CL custom log table definition now includes SecureConnectionStart as a persisted column.

Security Impact (Visibility and Fidelity)

Before this fix, Salesforce Event Log File (ELF) records that populated SECURE_CONNECTION_START – indicating the start of a TLS/SSL secure connection handshake – had that field silently discarded by the DCR transform. Any query against SalesforceServiceCloudV3_CL referencing SecureConnectionStart returned null for all rows.

This is a data fidelity gap, not a cosmetic fix. TLS connection-state fields are relevant for detecting degraded or anomalous transport-layer behaviour in Salesforce sessions (e.g., distinguishing encrypted vs. unencrypted connection paths, or correlating connection timing with suspicious access patterns). Deployments running v3.4.0 or earlier have had this field absent since the V3 table was introduced.

Note: a similarly named field SECURE_CONNECT_START (without the ION suffix) was already present in the schema; this PR adds the distinct SECURE_CONNECTION_START field – these are two separate Salesforce ELF columns.

Affected Files

Solutions/Salesforce Service Cloud/Data Connectors/SalesforceSentinelConnector_CCP/SalesforceServiceCloud_DCR.json
Solutions/Salesforce Service Cloud/Data Connectors/SalesforceSentinelConnector_CCP/SalesforceServiceCloud_Tables.json
(packaging artefacts: 3.4.1.zip, ReleaseNotes.md, Solution_TSalesforceCloudtemplateSpec.json, mainTemplate.json)