SalesForceRealTimeEventMonitoringConnector_CCF: Attempts to access PlannerId which only exists in the Source Event Objects if Agentforce is Enabled.

[drushbrook]

Describe the bug
The new Salesforce Realtime Event Monitoring Connector attempts to access PlannerId in both the ApiEvent and ReportEvent Salesforce objects. The PlannerId field is only available to customers licenced to use Agentforce and where Agentforce is explictly enabled/turned on.

Expected behavior
For customers that don't have Agentforce enabled then the connector should not attempt to query PlannerId on Line 104 and Line 1109.

Azure-Sentinel/Solutions/Salesforce Service Cloud/Data Connectors/SalesForceRealTimeEventMonitoringConnector_CCF/SalesforceRealTimeEventMonitoring_PollingConfig.json

Line 104 in 111ad73

"q": "SELECT ActionName, AdditionalInfo, ApiType, ApiVersion, Application, BotSessionIdentifier, Client, ConnectedAppId, CreatedDate, ElapsedTime, EvaluationTime, EventDate, EventIdentifier, LoginHistoryId, LoginKey, Operation, OperationStatus, PlannerId, Platform, PolicyId, PolicyOutcome, QueriedEntities, Query, Records, RelatedEventIdentifier, RequestIdentifier, RowsProcessed, RowsReturned, SessionKey, SessionLevel, SourceIp, UserAgent, UserId, Username FROM ApiEvent WHERE EventDate > {_QueryWindowStartTime} AND EventDate < {_QueryWindowEndTime}"

Azure-Sentinel/Solutions/Salesforce Service Cloud/Data Connectors/SalesForceRealTimeEventMonitoringConnector_CCF/SalesforceRealTimeEventMonitoring_PollingConfig.json

Line 1109 in 111ad73

"q": "SELECT ActionName, BotSessionIdentifier, ColumnHeaders, CreatedDate, DashboardId, DashboardName, Description, DisplayedFieldEntities, EvaluationTime, EventDate, EventIdentifier, EventSource, ExecutionIdentifier, ExportFileFormat, Format, GroupedColumnHeaders, IsScheduled, LoginHistoryId, LoginKey, Name, NumberOfColumns, Operation, OwnerId, PlannerId, PolicyId, PolicyOutcome, QueriedEntities, Records, RelatedEventIdentifier, ReportId, RowsProcessed, Scope, Sequence, SessionKey, SessionLevel, SourceIp, UserId, Username FROM ReportEvent WHERE EventDate > {_QueryWindowStartTime} AND EventDate < {_QueryWindowEndTime}"

Additional context
Please let me know if you wish for me to raise an enhancement for the ability for parameterising Agentforce being enabled or disabled thus should include or exclude this field.