Modified modeling rule (demisto#36423)

* Modified modeling rule * Added release notes
qmasters-ltd · Sep 26, 2024 · 1c6eac6 · 1c6eac6
1 parent c49e51a
commit 1c6eac6
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 3 deletions.
diff --git a/Packs/Okta/ModelingRules/OktaModelingRules_2_0/OktaModelingRules_2_0.xif b/Packs/Okta/ModelingRules/OktaModelingRules_2_0/OktaModelingRules_2_0.xif
@@ -197,9 +197,9 @@ alter
     check_target_alternateId = if(target_type !~= "User", null, target_alternateId = null, null, target_alternateId),    
     check_actor_displayName = if(actor_type = "user", actor_displayName, actor_type = "appuser", actor_displayName, null),
     check_target_displayName = if(target_type !~= "User", null, target_displaynames = null, null, target_displaynames),
-    check_actor_first_name = if(actor_type = "user", arrayindex(split(actor_displayName), 0) , actor_type = "appuser", arrayindex(split(actor_displayName), 0), null),
+    check_actor_first_name = if(actor_type in("user", "appuser"),  arrayindex(regextract(actor_displayName, "(^[^,\s]+)"), 0), null),
     check_target_first_name = if(target_type ~= "User", arrayindex(split(target_displaynames), 0) , null),
-    check_actor_last_name = if(actor_type = "user", arrayindex(split(actor_displayName), 1) , actor_type = "appuser", arrayindex(split(actor_displayName), 1), null),
+    check_actor_last_name = if(actor_type in("user", "appuser"), arrayindex(regextract(actor_displayName, "^[^,\s]+[,\s]+(.*)$"), 0), null),
     check_target_last_name = if(target_type ~= "User", arrayindex(split(target_displaynames), 1) , null),
     check_actor_id = if(actor_type = "user", actor_id, actor_type = "appuser", actor_id, null),
     check_target_id = if(target_type !~= "User", null, target_id = null, null, target_id),

diff --git a/Packs/Okta/ReleaseNotes/3_3_3.md b/Packs/Okta/ReleaseNotes/3_3_3.md
@@ -0,0 +1,3 @@
+#### Modeling Rules
+##### Okta 2.0 Modeling Rule
+Excluded "," from xdm.source.user.first_name and xdm.source.user.last_name fields' values.
diff --git a/Packs/Okta/pack_metadata.json b/Packs/Okta/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "Okta",
     "description": "Integration with Okta's cloud-based identity management service.",
     "support": "xsoar",
-    "currentVersion": "3.3.2",
+    "currentVersion": "3.3.3",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",