Skip to content

[SalesforceAuditLogsConnector] Remove LoginGeoId from LoginHistory query and refresh generated artifacts#14566

Open
v-hectorarv wants to merge 2 commits into
Azure:masterfrom
v-hectorarv:feature/salesforceaudit-login-geo-id
Open

[SalesforceAuditLogsConnector] Remove LoginGeoId from LoginHistory query and refresh generated artifacts#14566
v-hectorarv wants to merge 2 commits into
Azure:masterfrom
v-hectorarv:feature/salesforceaudit-login-geo-id

Conversation

@v-hectorarv

@v-hectorarv v-hectorarv commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

This PR updates the Salesforce Audit Logs connector to remove the LoginGeoId field from the LoginHistory polling query. The change keeps the connector aligned with the intended payload/schema handling for Login History ingestion and refreshes generated artifacts accordingly. It also updates sample input timestamps to consistent timezone-offset values while preserving event chronology.

Changes

  • Updated connector definition to remove LoginGeoId from the LoginHistory SOQL query.
  • Regenerated polling configuration and solution template artifacts to reflect the query change.
  • Updated sample input records with normalized timezone-offset formatting for CreatedDate/LoginTime fields.

Generated Artifacts

  • PollingConfig.json
  • mainTemplate.json
  • SalesforceAuditTrailSample.json
  • SalesforceLoginHistorySample.json

Testing

  • ✅ Data connector validated
  • ✅ Polling configurations tested
  • ✅ ARM template validation passed
  • ✅ Solution package generation successful
image

Related Issue

Resolves: https://msdata.visualstudio.com/Sentinel%20Graph/_workitems/edit/5358823

Checklist

  • Solution metadata updated
  • Data connector definitions regenerated
  • Parsers implemented and validated
  • Release notes added
  • Package generated successfully (version 3.5.0)
  • Least privilege permissions optimized

@v-hectorarv
Remove LoginGeoId from LoginHistory query and refresh generated artif…
84e84d2 
…acts

This PR updates the Salesforce Audit Logs connector to remove the LoginGeoId field from the LoginHistory polling query. The change keeps the connector aligned with the intended payload/schema handling for Login History ingestion and refreshes generated artifacts accordingly. It also updates sample input timestamps to consistent timezone-offset values while preserving event chronology.
@v-hectorarv
Add ReleaseNotes update
30a2d3e
@v-hectorarv v-hectorarv requested review from a team as code owners June 25, 2026 21:21
@v-maheshbh v-maheshbh added the Solution Solution specialty review needed label Jun 26, 2026
@v-maheshbh v-maheshbh assigned v-maheshbh and unassigned v-atulyadav Jun 26, 2026
@v-maheshbh v-maheshbh requested a review from Copilot June 26, 2026 04:12
Copilot AI reviewed Jun 26, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR updates the Salesforce Audit Logs connector to remove LoginGeoId from the LoginHistory SOQL polling query and refreshes the generated solution artifacts and versioning to match.

Changes:

  • Removed LoginGeoId from the LoginHistory polling SOQL query.
  • Bumped solution/package versions to 3.5.0 and refreshed generated artifacts (ARM template, polling config).
  • Adjusted a KQL transform’s null/empty handling for EventDate in the solution template.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 3 comments.

File Description
Solutions/Salesforce Service Cloud/ReleaseNotes.md Adds 3.5.0 release entry documenting the LoginGeoId query change.
Solutions/Salesforce Service Cloud/Package/mainTemplate.json Bumps versions to 3.5.0, updates SOQL query, and updates generated template strings/metadata.
Solutions/Salesforce Service Cloud/Data/Solution_TSalesforceCloudtemplateSpec.json Updates solution version to 3.5.0 for template spec packaging.
Solutions/Salesforce Service Cloud/Data Connectors/SalesforceAuditLogsConnector_CCF/SalesforceAuditLogs_PollingConfig.json Removes LoginGeoId from the LoginHistory polling query.

Comment thread Solutions/Salesforce Service Cloud/Package/mainTemplate.json
],
"outputStream": "Custom-SalesForceRealTimeEventMonitoring_CL",
"transformKql": "source | project TimeGenerated=iff(isempty(EventDate),now(),todatetime(EventDate)),EventType=EventType,EventDate=EventDate,EventIdentifier=EventIdentifier,UserId=UserId,LoginKey=LoginKey,SessionKey=SessionKey,SourceIp=SourceIp,EvaluationTime=EvaluationTime,PolicyId=PolicyId,PolicyOutcome=PolicyOutcome,SessionLevel=SessionLevel,RelatedEventIdentifier=RelatedEventIdentifier,LoginHistoryId=LoginHistoryId,CreatedDate=CreatedDate,EventUuid=EventUuid,ReplayId=ReplayId,CreatedById=CreatedById,LastReferencedDate=LastReferencedDate,LastViewedDate=LastViewedDate,QueriedEntities=QueriedEntities,Score=Score,Summary=Summary,Operation=Operation,SecurityEventData=SecurityEventData,RowsProcessed=RowsProcessed,UserAgent=UserAgent,UserType=UserType,Application=Application,LoginType=LoginType,Name=Name,Platform=Platform,Records=Records,ActionName=ActionName,AdditionalInfo=AdditionalInfo,AnomalySubType=AnomalySubType,ApiType=ApiType,AppName=AppName,BotId=BotId,BotSessionIdentifier=BotSessionIdentifier,Browser=Browser,City=City,ColumnHeaders=ColumnHeaders,Country=Country,CountryIso=CountryIso,EventSource=EventSource,ExecutionIdentifier=ExecutionIdentifier,LoginUrl=LoginUrl,NumberOfColumns=NumberOfColumns,OwnerId=OwnerId,PlannerId=PlannerId,PostalCode=PostalCode,Query=Query,RecordId=RecordId,RequestIdentifier=RequestIdentifier,Scope=Scope,Sequence=Sequence,Subdivision=Subdivision,AcceptLanguage=AcceptLanguage,Activity=Activity,ApiAnomalyEventNumber=ApiAnomalyEventNumber,ApiVersionNumber=ApiVersionNumber,ApiVersion=ApiVersion,AppId=AppId,AuthMethodReference=AuthMethodReference,AuthServiceId=AuthServiceId,AuthSessionId=AuthSessionId,CanDownloadPdf=CanDownloadPdf,CipherSuite=CipherSuite,Client=Client,ClientVersion=ClientVersion,ConnectedAppId=ConnectedAppId,ConnectionType=ConnectionType,ContentSize=ContentSize,CredentialStuffingEventNumber=CredentialStuffingEventNumber,CurrentIp=CurrentIp,CurrentPlatform=CurrentPlatform,CurrentScreen=CurrentScreen,CurrentUserAgent=CurrentUserAgent,CurrentWindow=CurrentWindow,DashboardId=DashboardId,DashboardName=DashboardName,DelegatedOrganizationId=DelegatedOrganizationId,DelegatedUsername=DelegatedUsername,Description=Description,DeveloperName=DeveloperName,DeviceId=DeviceId,DeviceModel=DeviceModel,DevicePlatform=DevicePlatform,DeviceSessionId=DeviceSessionId,DisplayedFieldEntities=DisplayedFieldEntities,DocumentId=DocumentId,Duration=Duration,EffectivePageTime=EffectivePageTime,EffectivePageTimeDeviationErrorType=EffectivePageTimeDeviationErrorType,EffectivePageTimeDeviationReason=EffectivePageTimeDeviationReason,ElapsedTime=ElapsedTime,ErrorCode=ErrorCode,EventGroup=EventGroup,EventSourceDetail=EventSourceDetail,ExportFileFormat=ExportFileFormat,FeatureContribution=FeatureContribution,FeatureName=FeatureName,FeatureValue=FeatureValue,FileAction=FileAction,FileName=FileName,FileSource=FileSource,FileType=FileType,FilterCriteria=FilterCriteria,Format=Format,ForwardedForIp=ForwardedForIp,GroupedColumnHeaders=GroupedColumnHeaders,GuestUserAnomalyEventNumber=GuestUserAnomalyEventNumber,HasEffectivePageTimeDeviation=HasEffectivePageTimeDeviation,HasExternalUsers=HasExternalUsers,HasLogoutUrl=HasLogoutUrl,HttpMethod=HttpMethod,HttpReferer=HttpReferer,SalesforceObjectId=Id,IdentityUsed=IdentityUsed,ImpactedUserIds=ImpactedUserIds,InitiatedBy=InitiatedBy,IsLatestVersion=IsLatestVersion,IsScheduled=IsScheduled,Latitude=Latitude,ListViewId=ListViewId,LoginAnomalyEventNumber=LoginAnomalyEventNumber,LoginAsCategory=LoginAsCategory,LoginAccessChangeExpDate=LoginAccessChangeExpDate,LoginAccessChangeGranteeName=LoginAccessChangeGranteeName,LoginAccessChangeGranteeType=LoginAccessChangeGranteeType,LoginGeoId=LoginGeoId,LoginLatitude=LoginLatitude,LoginLongitude=LoginLongitude,LoginSubType=LoginSubType,Longitude=Longitude,Message=Message,NetworkId=NetworkId,OperationDetail=OperationDetail,OperationStatus=OperationStatus,OrderBy=OrderBy,OsName=OsName,OsVersion=OsVersion,PageStartTime=PageStartTime,PageUrl=PageUrl,ParentIdList=ParentIdList,ParentNameList=ParentNameList,PermissionExpiration=PermissionExpiration,PermissionExpirationList=PermissionExpirationList,PermissionList=PermissionList,PermissionType=PermissionType,Policy=Policy,PreviousIp=PreviousIp,PreviousPageAppName=PreviousPageAppName,PreviousPageEntityId=PreviousPageEntityId,PreviousPageEntityType=PreviousPageEntityType,PreviousPageUrl=PreviousPageUrl,PreviousPlatform=PreviousPlatform,PreviousScreen=PreviousScreen,PreviousUserAgent=PreviousUserAgent,PreviousWindow=PreviousWindow,ProcessDuration=ProcessDuration,Remarks=Remarks,RemoteIdentifier=RemoteIdentifier,Report=Report,ReportAnomalyEventNumber=ReportAnomalyEventNumber,ReportId=ReportId,RequestedEntities=RequestedEntities,SalesforceResourceId=ResourceId,RowsReturned=RowsReturned,SamlEntityUrl=SamlEntityUrl,SdkAppType=SdkAppType,SdkAppVersion=SdkAppVersion,SdkVersion=SdkVersion,SessionHijackingEventNumber=SessionHijackingEventNumber,SoqlCommands=SoqlCommands,SsoType=SsoType,Status=Status,StatusDetail=StatusDetail,TargetUrl=TargetUrl,TlsProtocol=TlsProtocol,TotalControllerEvents=TotalControllerEvents,Uri=Uri,UseApiToken=UseApiToken,UserAgentDetail=UserAgentDetail,UserCount=UserCount,UserNameDetail=UserName,UserTypeDetail=UserTypeDetail,VerificationMethod=VerificationMethod,VersionId=VersionId,VersionNumber=VersionNumber"
"transformKql": "source | project TimeGenerated=iff(isnull(EventDate),now(),todatetime(EventDate)),EventType=EventType,EventDate=EventDate,EventIdentifier=EventIdentifier,UserId=UserId,LoginKey=LoginKey,SessionKey=SessionKey,SourceIp=SourceIp,EvaluationTime=EvaluationTime,PolicyId=PolicyId,PolicyOutcome=PolicyOutcome,SessionLevel=SessionLevel,RelatedEventIdentifier=RelatedEventIdentifier,LoginHistoryId=LoginHistoryId,CreatedDate=CreatedDate,EventUuid=EventUuid,ReplayId=ReplayId,CreatedById=CreatedById,LastReferencedDate=LastReferencedDate,LastViewedDate=LastViewedDate,QueriedEntities=QueriedEntities,Score=Score,Summary=Summary,Operation=Operation,SecurityEventData=SecurityEventData,RowsProcessed=RowsProcessed,UserAgent=UserAgent,UserType=UserType,Application=Application,LoginType=LoginType,Name=Name,Platform=Platform,Records=Records,ActionName=ActionName,AdditionalInfo=AdditionalInfo,AnomalySubType=AnomalySubType,ApiType=ApiType,AppName=AppName,BotId=BotId,BotSessionIdentifier=BotSessionIdentifier,Browser=Browser,City=City,ColumnHeaders=ColumnHeaders,Country=Country,CountryIso=CountryIso,EventSource=EventSource,ExecutionIdentifier=ExecutionIdentifier,LoginUrl=LoginUrl,NumberOfColumns=NumberOfColumns,OwnerId=OwnerId,PlannerId=PlannerId,PostalCode=PostalCode,Query=Query,RecordId=RecordId,RequestIdentifier=RequestIdentifier,Scope=Scope,Sequence=Sequence,Subdivision=Subdivision,AcceptLanguage=AcceptLanguage,Activity=Activity,ApiAnomalyEventNumber=ApiAnomalyEventNumber,ApiVersionNumber=ApiVersionNumber,ApiVersion=ApiVersion,AppId=AppId,AuthMethodReference=AuthMethodReference,AuthServiceId=AuthServiceId,AuthSessionId=AuthSessionId,CanDownloadPdf=CanDownloadPdf,CipherSuite=CipherSuite,Client=Client,ClientVersion=ClientVersion,ConnectedAppId=ConnectedAppId,ConnectionType=ConnectionType,ContentSize=ContentSize,CredentialStuffingEventNumber=CredentialStuffingEventNumber,CurrentIp=CurrentIp,CurrentPlatform=CurrentPlatform,CurrentScreen=CurrentScreen,CurrentUserAgent=CurrentUserAgent,CurrentWindow=CurrentWindow,DashboardId=DashboardId,DashboardName=DashboardName,DelegatedOrganizationId=DelegatedOrganizationId,DelegatedUsername=DelegatedUsername,Description=Description,DeveloperName=DeveloperName,DeviceId=DeviceId,DeviceModel=DeviceModel,DevicePlatform=DevicePlatform,DeviceSessionId=DeviceSessionId,DisplayedFieldEntities=DisplayedFieldEntities,DocumentId=DocumentId,Duration=Duration,EffectivePageTime=EffectivePageTime,EffectivePageTimeDeviationErrorType=EffectivePageTimeDeviationErrorType,EffectivePageTimeDeviationReason=EffectivePageTimeDeviationReason,ElapsedTime=ElapsedTime,ErrorCode=ErrorCode,EventGroup=EventGroup,EventSourceDetail=EventSourceDetail,ExportFileFormat=ExportFileFormat,FeatureContribution=FeatureContribution,FeatureName=FeatureName,FeatureValue=FeatureValue,FileAction=FileAction,FileName=FileName,FileSource=FileSource,FileType=FileType,FilterCriteria=FilterCriteria,Format=Format,ForwardedForIp=ForwardedForIp,GroupedColumnHeaders=GroupedColumnHeaders,GuestUserAnomalyEventNumber=GuestUserAnomalyEventNumber,HasEffectivePageTimeDeviation=HasEffectivePageTimeDeviation,HasExternalUsers=HasExternalUsers,HasLogoutUrl=HasLogoutUrl,HttpMethod=HttpMethod,HttpReferer=HttpReferer,SalesforceObjectId=Id,IdentityUsed=IdentityUsed,ImpactedUserIds=ImpactedUserIds,InitiatedBy=InitiatedBy,IsLatestVersion=IsLatestVersion,IsScheduled=IsScheduled,Latitude=Latitude,ListViewId=ListViewId,LoginAnomalyEventNumber=LoginAnomalyEventNumber,LoginAsCategory=LoginAsCategory,LoginAccessChangeExpDate=LoginAccessChangeExpDate,LoginAccessChangeGranteeName=LoginAccessChangeGranteeName,LoginAccessChangeGranteeType=LoginAccessChangeGranteeType,LoginGeoId=LoginGeoId,LoginLatitude=LoginLatitude,LoginLongitude=LoginLongitude,LoginSubType=LoginSubType,Longitude=Longitude,Message=Message,NetworkId=NetworkId,OperationDetail=OperationDetail,OperationStatus=OperationStatus,OrderBy=OrderBy,OsName=OsName,OsVersion=OsVersion,PageStartTime=PageStartTime,PageUrl=PageUrl,ParentIdList=ParentIdList,ParentNameList=ParentNameList,PermissionExpiration=PermissionExpiration,PermissionExpirationList=PermissionExpirationList,PermissionList=PermissionList,PermissionType=PermissionType,Policy=Policy,PreviousIp=PreviousIp,PreviousPageAppName=PreviousPageAppName,PreviousPageEntityId=PreviousPageEntityId,PreviousPageEntityType=PreviousPageEntityType,PreviousPageUrl=PreviousPageUrl,PreviousPlatform=PreviousPlatform,PreviousScreen=PreviousScreen,PreviousUserAgent=PreviousUserAgent,PreviousWindow=PreviousWindow,ProcessDuration=ProcessDuration,Remarks=Remarks,RemoteIdentifier=RemoteIdentifier,Report=Report,ReportAnomalyEventNumber=ReportAnomalyEventNumber,ReportId=ReportId,RequestedEntities=RequestedEntities,SalesforceResourceId=ResourceId,RowsReturned=RowsReturned,SamlEntityUrl=SamlEntityUrl,SdkAppType=SdkAppType,SdkAppVersion=SdkAppVersion,SdkVersion=SdkVersion,SessionHijackingEventNumber=SessionHijackingEventNumber,SoqlCommands=SoqlCommands,SsoType=SsoType,Status=Status,StatusDetail=StatusDetail,TargetUrl=TargetUrl,TlsProtocol=TlsProtocol,TotalControllerEvents=TotalControllerEvents,Uri=Uri,UseApiToken=UseApiToken,UserAgentDetail=UserAgentDetail,UserCount=UserCount,UserNameDetail=UserName,UserTypeDetail=UserTypeDetail,VerificationMethod=VerificationMethod,VersionId=VersionId,VersionNumber=VersionNumber"
Comment thread Solutions/Salesforce Service Cloud/Package/mainTemplate.json
{
"provider": "Microsoft.OperationalInsights/workspaces",
"permissionsDisplayText": "Read and Write permissions are required.",
"permissionsDisplayText": "Read, Write, and Delete permissions are required.",
Comment thread Solutions/Salesforce Service Cloud/Package/mainTemplate.json
{
"provider": "Microsoft.OperationalInsights/workspaces",
"permissionsDisplayText": "Read and Write permissions are required.",
"permissionsDisplayText": "Read, Write, and Delete permissions are required.",
@v-maheshbh

v-maheshbh commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

Hi @v-hectorarv

Kindly review the above comments, address them if needed, and mark them as resolved.

Thanks!

@v-maheshbh

v-maheshbh commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

Hi @v-hectorarv

Kindly review the above comments.

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

At least 1 approving review is required to merge this pull request.

Assignees

@v-maheshbh v-maheshbh

Labels

Codeless Connector Framework (CCF) Connector Solution Solution specialty review needed

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@v-hectorarv @v-maheshbh @v-atulyadav