Update Email Regex

panther-labs · Dec 2, 2024 · 0081b66 · 0081b66
1 parent f1eee0c
commit 0081b66
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 3 deletions.
diff --git a/rules/zoom_operation_rules/zoom_user_promoted_to_privileged_role.py b/rules/zoom_operation_rules/zoom_user_promoted_to_privileged_role.py
@@ -6,7 +6,9 @@
 def extract_values(event):
     operator = event.get("operator", "<operator-not-found>")
     operation_detail = event.get("operation_detail", "")
-    email = re.search(r"[\w.+-c]+@[\w-]+\.[\w.-]+", operation_detail)[0] or "<email-not-found>"
+    email = (
+        re.search(r"[\w.+%-]+@[\w.-]+\.[a-zA-Z]{2,}", operation_detail)[0] or "<email-not-found>"
+    )
     fromto = re.findall(r"from ([-\s\w]+) to ([-\s\w]+)", operation_detail) or [
         ("<from-role-not-found>", "<to-role-not-found>")
     ]

diff --git a/rules/zoom_operation_rules/zoom_user_promoted_to_privileged_role.yml b/rules/zoom_operation_rules/zoom_user_promoted_to_privileged_role.yml
@@ -11,7 +11,7 @@ Tests:
       action: Batch Update
       category_type: User
       operation_detail: "Change Role  - homer.simpson@duff.io: from User to Co-Owner"
-      operator: admin@duff.io
+      operator: admin-test%1223+123@duff.dev.co
       time: "2022-07-05 20:28:48"
     Name: Admin Promotion Event
   - ExpectedResult: false
@@ -59,7 +59,7 @@ Tests:
       action: SCIM API - Update
       category_type: User
       operation_detail: "Edit User homer.simpson@duff.co  - Change Type: from Basic to Licensed"
-      operator: admin@duff.co
+      operator: admin-test%1223+123@duff.dev.co
       time: "2022-07-01 22:05:22"
     Name: Other Event
 DedupPeriodMinutes: 60