What Changed

The SalesforceRTEM CCF connector polling configuration has been updated across all 19 Salesforce Real-Time Event Monitoring event types. Three changes are bundled in v3.4.2:

  1. SOQL query method - all per-event-type queries switched from explicit column enumeration to SELECT FIELDS(STANDARD) FROM per event store. Per the Salesforce SOQL reference, FIELDS(STANDARD) automatically enumerates all standard fields while respecting the callers field-level security (FLS) profile. Deployments using a Salesforce Connected App with restricted profiles were previously either receiving partial data (fields omitted silently) or failing queries if the explicit list contained a field the caller lacked permission to read.

  2. Column name correction - the DCR schema column UserName has been renamed to Username (lowercase n) to match the actual Salesforce field name. The transformKql projection has been updated from UserNameDetail=UserName to UserNameDetail=Username. Queries against Custom-SalesForceRealTimeEventMonitoring_CL that referenced UserName would have received null for all rows prior to this fix.

  3. DCR transform null-check fix - the TimeGenerated projection logic changed from iff(isnull(EventDate), now(), todatetime(EventDate)) to iff(isempty(EventDate), now(), todatetime(EventDate)). isnull() only catches typed null; isempty() correctly handles both null and empty-string EventDate values that Salesforce may return.

Security Impact (Visibility and Fidelity)

SOQL field-level security gap: Deployments where the Salesforce Connected App user lacked permission to one or more of the hardcoded field names in any of the 19 explicit SELECT lists would have experienced query failures or missing fields for that event type. The specific impact depends on the org FLS configuration - the worst case is complete ingestion failure for one or more event categories (e.g., ApiAnomalyEventStore, CredentialStuffingEventStore, SessionHijackingEventStore). Switching to FIELDS(STANDARD) retrieves only what the caller is permitted to see, eliminating permission-driven failures while ensuring the connector functions across any valid Salesforce profile.

Username column null: Any detections or hunting queries against Custom-SalesForceRealTimeEventMonitoring_CL that joined or filtered on UserName (capital N) would have received null for every row. Affected detections would silently return no results or produce incorrect entity attribution. The corrected column name Username now populates this field correctly.

EventDate empty-string handling: If Salesforce returned an empty-string EventDate (rather than a typed null), the previous isnull() check would have failed to catch it, causing todatetime errors in the DCR transform and potential row drops. The isempty() fix prevents transform failures for events with absent timestamps.

Affected Files

Solutions/Salesforce Service Cloud/Data Connectors/SalesForceRealTimeEventMonitoringConnector_CCF/SalesforceRealTimeEventMonitoring_DCR.json
Solutions/Salesforce Service Cloud/Data Connectors/SalesForceRealTimeEventMonitoringConnector_CCF/SalesforceRealTimeEventMonitoring_PollingConfig.json
(packaging artefacts: 3.4.2.zip, ReleaseNotes.md, Solution_TSalesforceCloudtemplateSpec.json, mainTemplate.json)