diff --git a/rules/zoom_operation_rules/zoom_user_promoted_to_privileged_role.py b/rules/zoom_operation_rules/zoom_user_promoted_to_privileged_role.py index e026fe303..8c25c8669 100644 --- a/rules/zoom_operation_rules/zoom_user_promoted_to_privileged_role.py +++ b/rules/zoom_operation_rules/zoom_user_promoted_to_privileged_role.py @@ -6,7 +6,9 @@ def extract_values(event): operator = event.get("operator", "") operation_detail = event.get("operation_detail", "") - email = re.search(r"[\w.+-c]+@[\w-]+\.[\w.-]+", operation_detail)[0] or "" + email = ( + re.search(r"[\w.+%-]+@[\w.-]+\.[a-zA-Z]{2,}", operation_detail)[0] or "" + ) fromto = re.findall(r"from ([-\s\w]+) to ([-\s\w]+)", operation_detail) or [ ("", "") ] diff --git a/rules/zoom_operation_rules/zoom_user_promoted_to_privileged_role.yml b/rules/zoom_operation_rules/zoom_user_promoted_to_privileged_role.yml index 507a72724..cbbfbc6e2 100644 --- a/rules/zoom_operation_rules/zoom_user_promoted_to_privileged_role.yml +++ b/rules/zoom_operation_rules/zoom_user_promoted_to_privileged_role.yml @@ -11,7 +11,7 @@ Tests: action: Batch Update category_type: User operation_detail: "Change Role - homer.simpson@duff.io: from User to Co-Owner" - operator: admin@duff.io + operator: admin-test%1223+123@duff.dev.co time: "2022-07-05 20:28:48" Name: Admin Promotion Event - ExpectedResult: false @@ -59,7 +59,7 @@ Tests: action: SCIM API - Update category_type: User operation_detail: "Edit User homer.simpson@duff.co - Change Type: from Basic to Licensed" - operator: admin@duff.co + operator: admin-test%1223+123@duff.dev.co time: "2022-07-01 22:05:22" Name: Other Event DedupPeriodMinutes: 60