[ASIM] Authentication - Salesforce Service Cloud - Codeless Connector Tables Support by SpeedyFireCyclone · Pull Request #14215 · Azure/Azure-Sentinel

SpeedyFireCyclone · 2026-05-06T09:16:48Z

Required items, please complete

Change(s):

Add support for codeless connector via SalesforceServiceCloudV2_CL table
Update unifying parser with pack parameter for the updated parser
Add support for updated connector via SalesforceServiceCloudV3_CL table

Reason for Change(s):

Support parsing logs from the latest codeless connector

Version Updated:

Yes

Testing Completed:

Yes

Checked that the validations are passing and have addressed any issues that are present:

Yes

…able

github-actions · 2026-05-06T09:24:13Z

🔒 Security Approval Required

This fork PR requires manual approval before automated testing can run.

For security, a maintainer must:

📝 Review the code changes carefully
✅ Verify file types - This PR should only contain .yml, .yaml, or .json files. Check for any executable scripts (.ps1, .py, .sh, .exe, etc.) which are not allowed in this context.
🏷️ Add the SafeToRun label if the changes are safe to execute

Note: If new commits are added later, simply remove and re-add the SafeToRun label.

🤖 Automated security check • Created: 2026-05-06T09:24:13.075Z
Learn more: GitHub Security Lab - Preventing PWN Requests

github-actions · 2026-05-06T09:46:58Z

🔒 Security Approval Required

This fork PR requires manual approval before automated testing can run.

For security, a maintainer must:

📝 Review the code changes carefully
✅ Verify file types - This PR should only contain .yml, .yaml, or .json files. Check for any executable scripts (.ps1, .py, .sh, .exe, etc.) which are not allowed in this context.
🏷️ Add the SafeToRun label if the changes are safe to execute

Note: If new commits are added later, simply remove and re-add the SafeToRun label.

🤖 Automated security check • Created: 2026-05-06T09:46:57.944Z
Learn more: GitHub Security Lab - Preventing PWN Requests

…able

github-actions · 2026-05-06T11:55:14Z

🔒 Security Approval Required

This fork PR requires manual approval before automated testing can run.

For security, a maintainer must:

📝 Review the code changes carefully
✅ Verify file types - This PR should only contain .yml, .yaml, or .json files. Check for any executable scripts (.ps1, .py, .sh, .exe, etc.) which are not allowed in this context.
🏷️ Add the SafeToRun label if the changes are safe to execute

Note: If new commits are added later, simply remove and re-add the SafeToRun label.

🤖 Automated security check • Created: 2026-05-06T11:55:14.497Z
Learn more: GitHub Security Lab - Preventing PWN Requests

v-atulyadav · 2026-05-26T09:08:07Z

Hi @SpeedyFireCyclone,
Please check for failed KQL validation as well as any branch conflicts. Thanks

v-atulyadav · 2026-06-01T05:47:40Z

Hi @SpeedyFireCyclone,

Please review the comments above and take the necessary action accordingly. Thanks

v-atulyadav · 2026-06-03T12:29:57Z

Hi @SpeedyFireCyclone,
Please resolve the branch conflicts. Thanks

… ASIM/AuthenticationSalesforceSC

… column.

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds support for newer Salesforce Service Cloud connector tables (V2/V3) in the ASIM Authentication Salesforce parsers, and wires a new pack parameter through the unifying parsers/ARM templates to optionally emit packed AdditionalFields.

Changes:

Update Salesforce Service Cloud parsers to read from SalesforceServiceCloud_CL, SalesforceServiceCloudV2_CL, and SalesforceServiceCloudV3_CL.
Add a pack: bool parameter to Salesforce Service Cloud parsers and propagate it through imAuthentication / ASimAuthentication and ARM deployments.
Refresh schema/data test baselines and update changelogs.

Reviewed changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
Parsers/ASimAuthentication/Parsers/vimAuthenticationSalesforceSC.yaml	Adds V2/V3 union + `pack` support and updated normalization logic for filtering parser
Parsers/ASimAuthentication/Parsers/ASimAuthenticationSalesforceSC.yaml	Adds V2/V3 union + `pack` support for non-filtering parser
Parsers/ASimAuthentication/Parsers/imAuthentication.yaml	Passes `pack` through to `vimAuthenticationSalesforceSC`
Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml	Passes `pack` through to `ASimAuthenticationSalesforceSC`
Parsers/ASimAuthentication/ARM/vimAuthenticationSalesforceSC/vimAuthenticationSalesforceSC.json	Updates deployed function KQL + adds `pack` parameter
Parsers/ASimAuthentication/ARM/vimAuthenticationSalesforceSC/README.md	Updates ARM README description for supported tables
Parsers/ASimAuthentication/ARM/imAuthentication/imAuthentication.json	Updates deployed unifying function to pass `pack` into Salesforce SC filtering parser
Parsers/ASimAuthentication/ARM/ASimAuthenticationSalesforceSC/ASimAuthenticationSalesforceSC.json	Updates deployed function KQL + adds `pack` parameter
Parsers/ASimAuthentication/ARM/ASimAuthenticationSalesforceSC/README.md	Updates ARM README description for supported tables
Parsers/ASimAuthentication/ARM/ASimAuthentication/ASimAuthentication.json	Updates deployed unifying function to pass `pack` into Salesforce SC ASim parser
Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationSalesforceSC.md	Changelog entry for v0.2.0 connector table support
Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationSalesforceSC.md	Changelog entry for v0.2.0 connector table support
Parsers/ASimAuthentication/CHANGELOG/imAuthentication.md	Changelog entry for v0.3.13 pack propagation
Parsers/ASimAuthentication/CHANGELOG/ASimAuthentication.md	Changelog entry for v0.2.16 pack propagation
Parsers/ASimAuthentication/Tests/Salesforce_Service Cloud_vimAuthentication_SchemaTest.csv	Updates expected schema-validation output for filtering parser
Parsers/ASimAuthentication/Tests/Salesforce_Service Cloud_vimAuthentication_DataTest.csv	Adds new data-validation baseline for filtering parser
Parsers/ASimAuthentication/Tests/Salesforce_Service Cloud_ASimAuthentication_SchemaTest.csv	Updates expected schema-validation output for ASim parser
Parsers/ASimAuthentication/Tests/Salesforce_Service Cloud_ASimAuthentication_DataTest.csv	Adds new data-validation baseline for ASim parser
.script/tests/KqlvalidationsTests/CustomTables/SalesforceServiceCloud_CL.json	Expands mocked custom table schema used by KQL validation tests

+            Application = TargetAppName,
+            EventStartTime = TimeGenerated,
+            EventEndTime = TimeGenerated
+        | extend ParsedHttpUserAgent = parse_user_agent(HttpUserAgent, "os").OperatingSystem


v-atulyadav · 2026-06-08T10:59:14Z

Hi @SpeedyFireCyclone,

Please review Copilot’s suggestions above and take the necessary action accordingly. Thanks

SpeedyFireCyclone · 2026-06-09T09:50:03Z

Abandoned in favor of #14423

…SalesforceSC

yummyblabla

Kqlvalidations failing due to missing _ItemId in V2 and V3 of the table. Should be straightforward to add.
{
"Name": "_ItemId",
"Type": "String"
}

Template validation is failing. Please fix so that it will the testers. I can run the testers manually if the testers fail to run.

Otherwise, parsers look good.

SpeedyFireCyclone added 2 commits May 6, 2026 11:11

Add support for updated connector using SalesforceServiceCloudV2_CL t…

59a27ee

…able

Update PR number reference

3aea5d5

SpeedyFireCyclone requested review from a team as code owners May 6, 2026 09:16

v-shukore assigned v-atulyadav May 6, 2026

v-shukore added the ASIM label May 6, 2026

SpeedyFireCyclone marked this pull request as draft May 6, 2026 11:04

Add support for updated connector using SalesforceServiceCloudV3_CL t…

8b9860f

…able

SpeedyFireCyclone changed the title ~~[ASIM] Authentication - Salesforce Service Cloud - SalesforceServiceCloudV2_CL table support~~ [ASIM] Authentication - Salesforce Service Cloud - Codeless Connector Tables Support May 6, 2026

SpeedyFireCyclone marked this pull request as ready for review May 6, 2026 11:50

v-atulyadav added the SafeToRun This is used only for ASim parsers Fork PR Pipeline run. label May 26, 2026

SpeedyFireCyclone added 4 commits June 3, 2026 15:57

Merge branch 'master' of https://github.com/Azure/Azure-Sentinel into…

d3ea73b

… ASIM/AuthenticationSalesforceSC

Update SalesforceServiceCloud_CL.json with current version of the schema

79a215f

coalesce for TargetUsername mapping of potentially missing "UserName"…

4a0b89d

… column.

Update kqlFuncYaml2Arm generated templates

c2b8506

v-atulyadav removed the SafeToRun This is used only for ASim parsers Fork PR Pipeline run. label Jun 8, 2026

v-atulyadav requested a review from Copilot June 8, 2026 10:14

v-atulyadav added the SafeToRun This is used only for ASim parsers Fork PR Pipeline run. label Jun 8, 2026

Copilot AI reviewed Jun 8, 2026

View reviewed changes

v-atulyadav added 2 commits June 8, 2026 16:21

Merge branch 'master' into pr/14215

105edee

Update ASimAuthenticationSalesforceSC.yaml

1d800c8

v-atulyadav added SafeToRun This is used only for ASim parsers Fork PR Pipeline run. and removed SafeToRun This is used only for ASim parsers Fork PR Pipeline run. labels Jun 8, 2026

SpeedyFireCyclone closed this Jun 9, 2026

SpeedyFireCyclone reopened this Jun 25, 2026

SpeedyFireCyclone mentioned this pull request Jun 25, 2026

[ASIM] Create authentication parser for SalesforceServiceCloudV2_CL #14423

Closed

SpeedyFireCyclone added 3 commits June 25, 2026 15:32

Query fixes and LastUpdated metadata consistency

ac3eaa6

Build updated templates

99df6c3

Merge remote-tracking branch 'origin/master' into ASIM/Authentication…

796e9dc

…SalesforceSC

yummyblabla added SafeToRun This is used only for ASim parsers Fork PR Pipeline run. and removed SafeToRun This is used only for ASim parsers Fork PR Pipeline run. labels Jun 25, 2026

yummyblabla reviewed Jun 25, 2026

View reviewed changes

Comment thread Parsers/ASimAuthentication/Parsers/vimAuthenticationSalesforceSC.yaml Outdated

SpeedyFireCyclone added 7 commits June 26, 2026 09:42

Add sample data

bbc3bab

Fix parser template metadata & earlier filtering

45a6af8

Update ARM template

e537c69

Add missing fields to table definitions

b93ee2e

Fix sample data filename

ef64c3f

Parser Refererences update & formatting for consistency

23d8192

Rebuild ARM templates

f642358

yummyblabla added SafeToRun This is used only for ASim parsers Fork PR Pipeline run. and removed SafeToRun This is used only for ASim parsers Fork PR Pipeline run. labels Jun 26, 2026

yummyblabla approved these changes Jun 26, 2026

View reviewed changes

yummyblabla merged commit 111ad73 into Azure:master Jun 26, 2026
32 of 36 checks passed

Uh oh!

Conversation

SpeedyFireCyclone commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 6, 2026

Uh oh!

github-actions Bot commented May 6, 2026

Uh oh!

github-actions Bot commented May 6, 2026

Uh oh!

v-atulyadav commented May 26, 2026

Uh oh!

v-atulyadav commented Jun 1, 2026

Uh oh!

v-atulyadav commented Jun 3, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

v-atulyadav commented Jun 8, 2026

Uh oh!

SpeedyFireCyclone commented Jun 9, 2026

Uh oh!

yummyblabla left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

SpeedyFireCyclone commented May 6, 2026 •

edited

Loading