From 1c6eac6dfa99361e11414a079addf801129a32ce Mon Sep 17 00:00:00 2001
From: yasta5 <112320333+yasta5@users.noreply.github.com>
Date: Thu, 26 Sep 2024 10:45:18 +0300
Subject: [PATCH] Modified modeling rule (#36423)

* Modified modeling rule

* Added release notes
---
 .../OktaModelingRules_2_0/OktaModelingRules_2_0.xif           | 4 ++--
 Packs/Okta/ReleaseNotes/3_3_3.md                              | 3 +++
 Packs/Okta/pack_metadata.json                                 | 2 +-
 3 files changed, 6 insertions(+), 3 deletions(-)
 create mode 100644 Packs/Okta/ReleaseNotes/3_3_3.md

diff --git a/Packs/Okta/ModelingRules/OktaModelingRules_2_0/OktaModelingRules_2_0.xif b/Packs/Okta/ModelingRules/OktaModelingRules_2_0/OktaModelingRules_2_0.xif
index 78cbe8ffed4..30b48ac098d 100644
--- a/Packs/Okta/ModelingRules/OktaModelingRules_2_0/OktaModelingRules_2_0.xif
+++ b/Packs/Okta/ModelingRules/OktaModelingRules_2_0/OktaModelingRules_2_0.xif
@@ -197,9 +197,9 @@ alter
     check_target_alternateId = if(target_type !~= "User", null, target_alternateId = null, null, target_alternateId),    
     check_actor_displayName = if(actor_type = "user", actor_displayName, actor_type = "appuser", actor_displayName, null),
     check_target_displayName = if(target_type !~= "User", null, target_displaynames = null, null, target_displaynames),
-    check_actor_first_name = if(actor_type = "user", arrayindex(split(actor_displayName), 0) , actor_type = "appuser", arrayindex(split(actor_displayName), 0), null),
+    check_actor_first_name = if(actor_type in("user", "appuser"),  arrayindex(regextract(actor_displayName, "(^[^,\s]+)"), 0), null),
     check_target_first_name = if(target_type ~= "User", arrayindex(split(target_displaynames), 0) , null),
-    check_actor_last_name = if(actor_type = "user", arrayindex(split(actor_displayName), 1) , actor_type = "appuser", arrayindex(split(actor_displayName), 1), null),
+    check_actor_last_name = if(actor_type in("user", "appuser"), arrayindex(regextract(actor_displayName, "^[^,\s]+[,\s]+(.*)$"), 0), null),
     check_target_last_name = if(target_type ~= "User", arrayindex(split(target_displaynames), 1) , null),
     check_actor_id = if(actor_type = "user", actor_id, actor_type = "appuser", actor_id, null),
     check_target_id = if(target_type !~= "User", null, target_id = null, null, target_id),
diff --git a/Packs/Okta/ReleaseNotes/3_3_3.md b/Packs/Okta/ReleaseNotes/3_3_3.md
new file mode 100644
index 00000000000..8c7ad7e3d1d
--- /dev/null
+++ b/Packs/Okta/ReleaseNotes/3_3_3.md
@@ -0,0 +1,3 @@
+#### Modeling Rules
+##### Okta 2.0 Modeling Rule
+Excluded "," from xdm.source.user.first_name and xdm.source.user.last_name fields' values.
diff --git a/Packs/Okta/pack_metadata.json b/Packs/Okta/pack_metadata.json
index 1972b7f4a45..a957ca6b55a 100644
--- a/Packs/Okta/pack_metadata.json
+++ b/Packs/Okta/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "Okta",
     "description": "Integration with Okta's cloud-based identity management service.",
     "support": "xsoar",
-    "currentVersion": "3.3.2",
+    "currentVersion": "3.3.3",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",