What Changed

Version 3.2.0 of the Salesforce Service Cloud solution introduces a new SalesforceServiceCloudV3_CL table with expanded field coverage and adds multi-domain support to the CCF data connector.

Security Impact (Visibility & Fidelity)

The new V3 table includes “all fields from all events within the event log files” — significantly expanding telemetry coverage beyond the previous V2 implementation. This addresses potential data fidelity gaps where security-relevant fields may have been excluded from ingestion.

The multi-domain capability allows a single workspace to monitor Salesforce events across multiple organizational domains, improving visibility into complex enterprise environments where Salesforce instances span multiple business units or subsidiaries.

Enhanced Data Collection

  • New table: SalesforceServiceCloudV3_CL with comprehensive field mapping
  • Multi-domain support: Single connector can now ingest from multiple Salesforce domains
  • Updated parser: Automatically includes V3 data via union isfuzzy=true SalesforceServiceCloudV3_CL
  • Backward compatibility: Existing V2 table ingestion continues alongside V3

Deployment Considerations

Organizations already using Salesforce Service Cloud connector should review the enhanced field coverage to identify new detection opportunities. The connector now requires “Connector Alias” configuration for multi-domain deployments.

Affected Files

.script/tests/KqlvalidationsTests/CustomTables/SalesforceServiceCloud.json
.script/tests/KqlvalidationsTests/CustomTables/SalesforceServiceCloudV3_CL.json
Solutions/Salesforce Service Cloud/Data Connectors/SalesforceSentinelConnector_CCP/SalesforceServiceCloud_DCR.json
Solutions/Salesforce Service Cloud/Data Connectors/SalesforceSentinelConnector_CCP/SalesforceServiceCloud_DataConnectorDefinition.json
Solutions/Salesforce Service Cloud/Data Connectors/SalesforceSentinelConnector_CCP/SalesforceServiceCloud_PollingConfig.json
Solutions/Salesforce Service Cloud/Data Connectors/SalesforceSentinelConnector_CCP/SalesforceServiceCloud_Tables.json
Solutions/Salesforce Service Cloud/Parsers/SalesforceServiceCloud.yaml
Tools/Create-Azure-Sentinel-Solution/common/createCCPConnector.ps1
(packaging artefacts: 3.2.0.zip, ReleaseNotes.md, Solution_TSalesforceCloudtemplateSpec.json, mainTemplate.json)