Repository: SEKOIA-IO/intake-formats
Pull request #1651: Fix: VMWare quotes (623)
Author: login: vg-svitla
Created: 2025-05-06T10:21:26Z | Merged: 2025-05-14T12:42:27Z

Closes [623](https://github.com/SekoiaLab/integration/issues/623)

## Summary by Sourcery

Bug Fixes:
- Modify username regex pattern to optionally support single quotes around usernames


Diff:
diff --git a/VMWare/vmware-vcenter/ingest/parser.yml b/VMWare/vmware-vcenter/ingest/parser.yml
index e5963d6bbf..e927be54f9 100644
--- a/VMWare/vmware-vcenter/ingest/parser.yml
+++ b/VMWare/vmware-vcenter/ingest/parser.yml
@@ -27,7 +27,8 @@ pipeline:
           OTHERS_EVENTS_TYPE_7: 'Event \[%{INT:id}\] \[1-1\] \[%{TIMESTAMP_ISO8601:timestamp}\] \[%{DATA:event_code}\] \[%{DATA:log_level}\] \[%{USERNAME_WITH_DOMAIN}?\] \[%{HOSTNAME:hostname}?\] \[%{INT}] \[(?P<reason>%{DATA} from %{IP:source_ip} %{GREEDYDATA})\]'
           OTHERS_EVENTS_TYPE_7_1: 'Event \[%{INT:id}\] \[1-1\] \[%{TIMESTAMP_ISO8601:timestamp}\] \[%{DATA:event_code}\] \[%{DATA:log_level}\] \[%{USERNAME_WITH_DOMAIN}?\] \[%{HOSTNAME:hostname}?\] \[%{INT}] \[%{GREEDYDATA:reason}\]'
           OTHERS_EVENTS_TYPE_8: '%{TIMESTAMP_ISO8601:timestamp} %{DATA}\s+%{DATA}\s+%{DATA}\s+%{DATA}\s+%{DATA}\s+%{DATA}\s+: PWD=%{DATA:pwd} ; USER=%{DATA:proc_username} ; COMMAND=%{DATA:command_line}'
-          USERNAME_WITH_DOMAIN: '(%{DATA:user_domain}\\)?%{DATA:username}(@(%{IP:ip_address}|%{DATA:user_domain}))?'
+          USERNAME_WITH_DOMAIN: '%{SINGLE_QUOTE}?(%{DATA:user_domain}\\)?%{DATA:username}(@(%{IP:ip_address}|%{DATA:user_domain}))?%{SINGLE_QUOTE}?'
+          SINGLE_QUOTE: "'"
 
   - name: parsed_json
     filter: '{{parsed_event.message.LOGIN != None and parsed_event.message.reason | re_match("^\\s*\\{.*\\}\\s*$")}}'
diff --git a/VMWare/vmware-vcenter/tests/test_correct_username_1.json b/VMWare/vmware-vcenter/tests/test_correct_username_1.json
new file mode 100644
index 0000000000..cff761c431
--- /dev/null
+++ b/VMWare/vmware-vcenter/tests/test_correct_username_1.json
@@ -0,0 +1,51 @@
+{
+  "input": {
+    "message": "Event [11111111] [1-1] [2025-05-02T08:32:08.473238Z] [vim.event.EventEx] [info] [] [TESTHOSTNAME] [11111111] [SSH session was closed for 'root@2.3.4.5'.]",
+    "sekoiaio": {
+      "intake": {
+        "dialect": "VMware vCenter",
+        "dialect_uuid": "0642b03a-9d4a-4c88-a5e2-4597e366b8c4"
+      }
+    }
+  },
+  "expected": {
+    "message": "Event [11111111] [1-1] [2025-05-02T08:32:08.473238Z] [vim.event.EventEx] [info] [] [TESTHOSTNAME] [11111111] [SSH session was closed for 'root@2.3.4.5'.]",
+    "event": {
+      "category": [
+        "authentication"
+      ],
+      "code": "vim.event.EventEx",
+      "outcome": "success",
+      "reason": "SSH session was closed for 'root@2.3.4.5'.",
+      "type": [
+        "info"
+      ]
+    },
+    "@timestamp": "2025-05-02T08:32:08.473238Z",
+    "host": {
+      "ip": "2.3.4.5",
+      "name": "TESTHOSTNAME"
+    },
+    "log": {
+      "level": "info"
+    },
+    "observer": {
+      "product": "VCenter",
+      "vendor": "VMWare"
+    },
+    "related": {
+      "ip": [
+        "2.3.4.5"
+      ],
+      "user": [
+        "root"
+      ]
+    },
+    "user": {
+      "name": "root"
+    },
+    "vmware_vcenter": {
+      "event_id": "11111111"
+    }
+  }
+}
\ No newline at end of file
diff --git a/VMWare/vmware-vcenter/tests/test_correct_username_2.json b/VMWare/vmware-vcenter/tests/test_correct_username_2.json
new file mode 100644
index 0000000000..0c9be3eb92
--- /dev/null
+++ b/VMWare/vmware-vcenter/tests/test_correct_username_2.json
@@ -0,0 +1,51 @@
+{
+  "input": {
+    "message": "Event [11111111] [1-1] [2025-05-02T00:24:35.417208Z] [vim.event.EventEx] [info] [] [TESTHOSTNAME] [11111111] [SSH session was closed for 'test@1.2.3.4'.]",
+    "sekoiaio": {
+      "intake": {
+        "dialect": "VMware vCenter",
+        "dialect_uuid": "0642b03a-9d4a-4c88-a5e2-4597e366b8c4"
+      }
+    }
+  },
+  "expected": {
+    "message": "Event [11111111] [1-1] [2025-05-02T00:24:35.417208Z] [vim.event.EventEx] [info] [] [TESTHOSTNAME] [11111111] [SSH session was closed for 'test@1.2.3.4'.]",
+    "event": {
+      "category": [
+        "authentication"
+      ],
+      "code": "vim.event.EventEx",
+      "outcome": "success",
+      "reason": "SSH session was closed for 'test@1.2.3.4'.",
+      "type": [
+        "info"
+      ]
+    },
+    "@timestamp": "2025-05-02T00:24:35.417208Z",
+    "host": {
+      "ip": "1.2.3.4",
+      "name": "TESTHOSTNAME"
+    },
+    "log": {
+      "level": "info"
+    },
+    "observer": {
+      "product": "VCenter",
+      "vendor": "VMWare"
+    },
+    "related": {
+      "ip": [
+        "1.2.3.4"
+      ],
+      "user": [
+        "test"
+      ]
+    },
+    "user": {
+      "name": "test"
+    },
+    "vmware_vcenter": {
+      "event_id": "11111111"
+    }
+  }
+}
\ No newline at end of file


Reviews:
user: login: sourcery-ai[bot]
body: Hey @vg-svitla - I've reviewed your changes - here's some feedback:

- The current `USERNAME_WITH_DOMAIN` pattern allows for usernames with unmatched single quotes (e.g., `'user` or `user'`); please confirm if this behavior is intended to handle such cases.

<details>
<summary>Here's what I looked at during the review</summary>

- 🟢 **General issues**: all looks good
- 🟢 **Security**: all looks good
- 🟢 **Testing**: all looks good
- 🟢 **Complexity**: all looks good
- 🟢 **Documentation**: all looks good
</details>

***

<details>
<summary>Sourcery is free for open source - if you like our reviews please consider sharing them ✨</summary>

- [X](https://twitter.com/intent/tweet?text=I%20just%20got%20an%20instant%20code%20review%20from%20%40SourceryAI%2C%20and%20it%20was%20brilliant%21%20It%27s%20free%20for%20open%20source%20and%20has%20a%20free%20trial%20for%20private%20code.%20Check%20it%20out%20https%3A//sourcery.ai)
- [Mastodon](https://mastodon.social/share?text=I%20just%20got%20an%20instant%20code%20review%20from%20%40SourceryAI%2C%20and%20it%20was%20brilliant%21%20It%27s%20free%20for%20open%20source%20and%20has%20a%20free%20trial%20for%20private%20code.%20Check%20it%20out%20https%3A//sourcery.ai)
- [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https://sourcery.ai)
- [Facebook](https://www.facebook.com/sharer/sharer.php?u=https://sourcery.ai)

</details>

<sub>
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
</sub>
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-06T10:23:48Z
user: login: TOUFIKIzakarya
body: Thanks for the work. 
Some changes to do. 
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-06T13:46:01Z
user: login: TOUFIKIzakarya
body: LGFM
state: APPROVED
author_association: COLLABORATOR
submitted_at: 2025-05-12T08:45:36Z
user: login: squioc
body: LGTM. Thank you for the contribution.
state: APPROVED
author_association: COLLABORATOR
submitted_at: 2025-05-14T12:41:14Z

Review comments:
diff_hunk: @@ -0,0 +1,51 @@
+{
+  "input": {
+    "message": "Event [11111111] [1-1] [2025-05-02T08:32:08.473238Z] [vim.event.EventEx] [info] [] [INFOLOGIC] [11111111] [SSH session was closed for 'root@2.3.4.5'.]",
+    "sekoiaio": {
+      "intake": {
+        "dialect": "VMware vCenter",
+        "dialect_uuid": "0642b03a-9d4a-4c88-a5e2-4597e366b8c4"
+      }
+    }
+  },
+  "expected": {
+    "message": "Event [11111111] [1-1] [2025-05-02T08:32:08.473238Z] [vim.event.EventEx] [info] [] [INFOLOGIC] [11111111] [SSH session was closed for 'root@2.3.4.5'.]",
+    "event": {
+      "category": [
+        "authentication"
+      ],
+      "code": "vim.event.EventEx",
+      "outcome": "success",
+      "reason": "SSH session was closed for 'root@2.3.4.5'.",
+      "type": [
+        "info"
+      ]
+    },
+    "@timestamp": "2025-05-02T08:32:08.473238Z",
+    "host": {
+      "ip": "2.3.4.5",
+      "name": "INFOLOGIC"
path: VMWare/vmware-vcenter/tests/test_correct_username_1.json
user: login: TOUFIKIzakarya
body: I think we have to anonymize this `host.name`
created_at: 2025-05-06T13:45:05Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,51 @@
+{
+  "input": {
+    "message": "Event [11111111] [1-1] [2025-05-02T00:24:35.417208Z] [vim.event.EventEx] [info] [] [VXRAIL-DC-CIRCET] [11111111] [SSH session was closed for 'test@1.2.3.4'.]",
+    "sekoiaio": {
+      "intake": {
+        "dialect": "VMware vCenter",
+        "dialect_uuid": "0642b03a-9d4a-4c88-a5e2-4597e366b8c4"
+      }
+    }
+  },
+  "expected": {
+    "message": "Event [11111111] [1-1] [2025-05-02T00:24:35.417208Z] [vim.event.EventEx] [info] [] [VXRAIL-DC-CIRCET] [11111111] [SSH session was closed for 'test@1.2.3.4'.]",
+    "event": {
+      "category": [
+        "authentication"
+      ],
+      "code": "vim.event.EventEx",
+      "outcome": "success",
+      "reason": "SSH session was closed for 'test@1.2.3.4'.",
+      "type": [
+        "info"
+      ]
+    },
+    "@timestamp": "2025-05-02T00:24:35.417208Z",
+    "host": {
+      "ip": "1.2.3.4",
+      "name": "VXRAIL-DC-CIRCET"
path: VMWare/vmware-vcenter/tests/test_correct_username_2.json
user: login: TOUFIKIzakarya
body: The same for this one
created_at: 2025-05-06T13:45:26Z
author_association: COLLABORATOR

PR comments:
user: login: github-actions[bot]
created_at: 2025-05-06T10:21:57Z
body: Smart descriptions generated from the latest tests at 2025-05-14 12:42:11:
| Test File | Smart Description |
|---|---|
|[VMWare/vmware-vcenter/tests/command_line.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/command_line.json)|`/usr/lib/vmware-observability/scripts/createDBRole.sh` executed in `/` as `root`|
|[VMWare/vmware-vcenter/tests/connections_logs.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/connections_logs.json)|Connected to `test.example.org`|
|[VMWare/vmware-vcenter/tests/fault_logs.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/fault_logs.json)|`VMOMI activation LRO failed`|
|[VMWare/vmware-vcenter/tests/fault_logs2.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/fault_logs2.json)|`[VpxLRO] -- ERROR lro-1926720284 -- SessionManager -- vim.SessionManager.login`|
|[VMWare/vmware-vcenter/tests/http_logs_1.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/http_logs_1.json)|`1.2.3.4` requested `/sdk`|
|[VMWare/vmware-vcenter/tests/http_logs_2.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/http_logs_2.json)|`1.2.3.4` requested `/lookupservice/sdk`|
|[VMWare/vmware-vcenter/tests/login_failure.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/login_failure.json)|User `jesuisuntest` failed to log from `1.2.3.4`|
|[VMWare/vmware-vcenter/tests/login_success.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/login_success.json)|User `USER01` successfully logs from `1.2.3.4`|
|[VMWare/vmware-vcenter/tests/other_tests_example1_type_7.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/other_tests_example1_type_7.json)|`Task VMware vSphere Update Manager Check Notification on Datacenters in datacenter completed successfully`|
|[VMWare/vmware-vcenter/tests/other_tests_example2_type_7.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/other_tests_example2_type_7.json)|`Hardware Sensor Status: Processor Green, Memory Green, Fan Green, Voltage Green, Temperature Green, Power Green, System Board Green, Battery Green, Storage Green, Other Green`|
|[VMWare/vmware-vcenter/tests/other_tests_example3_type_7.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/other_tests_example3_type_7.json)|User `testuser` failed to log from `1.2.3.4`|
|[VMWare/vmware-vcenter/tests/other_tests_example4_type_7.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/other_tests_example4_type_7.json)|User `JOHNDOE` successfully logs from `1.2.3.4`|
|[VMWare/vmware-vcenter/tests/others_events.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/others_events.json)|`FINISH lro--1111111111`|
|[VMWare/vmware-vcenter/tests/others_events_test2.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/others_events_test2.json)|`BEGIN lro--1111111111 -- ServiceInstance -- vim.ServiceInstance.retrieveContent -- 47f5e298-9aee-4e21-b69b-abc3efd9cd4e(54b2ae59-1b21-4de8-bab0-0d9a415debce)`|
|[VMWare/vmware-vcenter/tests/others_events_type2.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/others_events_type2.json)|`Calling bulkUpdate with datastore=ds:///vmfs/volumes/1111111-22222222/ fullSync=false changed size: 0 tidyVClock=0 serverLastVClock=-1`|
|[VMWare/vmware-vcenter/tests/others_events_type3.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/others_events_type3.json)|`GC (Allocation Failure)`|
|[VMWare/vmware-vcenter/tests/others_events_type5.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/others_events_type5.json)|`PI-client-connection-monitor c.v.v.a.vapi.runtime.thread.ApacheBioHttpClientBuilderAspect vAPI-client-connection-monitor thread started...`|
|[VMWare/vmware-vcenter/tests/others_tests_example1_type_6.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/others_tests_example1_type_6.json)|A ticket for `root` on `5.6.7.8` has been acquired|
|[VMWare/vmware-vcenter/tests/others_tests_example2_type_6.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/others_tests_example2_type_6.json)|A ticket for `john.doe` on `5.6.7.8` has been acquired|
|[VMWare/vmware-vcenter/tests/others_tests_example3_type3.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/others_tests_example3_type3.json)|`WeakReference, 0 refs, 0.0000061 secs`|
|[VMWare/vmware-vcenter/tests/others_tests_example4_type3.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/others_tests_example4_type3.json)|`FinalReference, 150 refs, 0.0004388 secs`|
|[VMWare/vmware-vcenter/tests/others_tests_example5_type3.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/others_tests_example5_type3.json)|`PhantomReference, 0 refs, 0 refs, 0.0000065 secs`|
|[VMWare/vmware-vcenter/tests/others_tests_example6_type3.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/others_tests_example6_type3.json)|`JNI Weak Reference, 0.0000149 secs`|
|[VMWare/vmware-vcenter/tests/others_tests_example_type3.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/others_tests_example_type3.json)|`SoftReference, 0 refs, 0.0000457 secs`|
|[VMWare/vmware-vcenter/tests/session_logs_type1.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/session_logs_type1.json)|`Cannot login local-vpxuser@5.6.7.8`|
|[VMWare/vmware-vcenter/tests/session_logs_type2.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/session_logs_type2.json)|`User VSPHERE.LOCAL\vpxd-extension-3876e603-9146-4105-90ff-075afdf17160@10.79.48.3 logged in as VMware vim-java 1.0`|
|[VMWare/vmware-vcenter/tests/session_logs_type2_3.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/session_logs_type2_3.json)|`User DOMAIN\JOHNDOE@127.0.0.1 logged in as VMware vim-java 1.0`|
|[VMWare/vmware-vcenter/tests/session_logs_type2bis.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/session_logs_type2bis.json)|`User root@127.0.0.1 logged in as pyvmomi`|
|[VMWare/vmware-vcenter/tests/session_logs_type3.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/session_logs_type3.json)|`User root@127.0.0.1 logged out`|
|[VMWare/vmware-vcenter/tests/session_logs_type3_wo_hostname.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/session_logs_type3_wo_hostname.json)|`User root\example@127.0.0.1 logged out`|
|[VMWare/vmware-vcenter/tests/session_logs_type4.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/session_logs_type4.json)|`SSH session was opened for root@1.2.3.4.`|
|[VMWare/vmware-vcenter/tests/session_logs_type5.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/session_logs_type5.json)|`SSH session was closed for root@1.2.3.4.`|
|[VMWare/vmware-vcenter/tests/session_logs_type6.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/session_logs_type6.json)|`already logged on`|
|[VMWare/vmware-vcenter/tests/session_logs_type7.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/session_logs_type7.json)|User `testuser` failed to log from `1.2.3.4`|
|[VMWare/vmware-vcenter/tests/session_logs_type8.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/session_logs_type8.json)|`User TTTT\XXXXXXXX@127.0.0.1 logged in as VMware vim-java 1.0`|
|[VMWare/vmware-vcenter/tests/session_logs_type9.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/session_logs_type9.json)|User `test` successfully logs from `1.2.3.4`|
|[VMWare/vmware-vcenter/tests/session_logs_type_1_2.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/session_logs_type_1_2.json)|`User EXAMPLE\john_doe@1.2.3.4 logged in as JAAA-WS RI 2.3.0 svn-revision#3528ea595bd29309f69172d231bbce272d21999c`|
|[VMWare/vmware-vcenter/tests/test_correct_username_1.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/test_correct_username_1.json)|`SSH session was closed for 'root@2.3.4.5'.`|
|[VMWare/vmware-vcenter/tests/test_correct_username_2.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/test_correct_username_2.json)|`SSH session was closed for 'test@1.2.3.4'.`|
|[VMWare/vmware-vcenter/tests/test_properly_escaped_json.json](https://github.com/SEKOIA-IO/intake-formats/blob/ccbcc97c975bec8536ee5fc6a87540731ba2bac2/VMWare/vmware-vcenter/tests/test_properly_escaped_json.json)|User `administrator` successfully logs from `1.2.3.4`|
author_association: NONE
user: login: sourcery-ai[bot]
created_at: 2025-05-06T10:22:10Z
body: <!-- Generated by sourcery-ai[bot]: start review_guide -->

## Reviewer's Guide

This pull request updates the grok parsing logic within `VMWare/vmware-vcenter/ingest/parser.yml` to correctly handle usernames that may be enclosed in single quotes. This is achieved by modifying the `USERNAME_WITH_DOMAIN` grok pattern to optionally match these quotes and by adding a new `SINGLE_QUOTE` pattern. New test files have also been added to validate this parsing enhancement.

### File-Level Changes

| Change | Details | Files |
| ------ | ------- | ----- |
| Enhanced username grok pattern to support optional single quotes. | <ul><li>Modified the `USERNAME_WITH_DOMAIN` pattern to optionally match single quotes at the beginning and end.</li><li>Introduced a new `SINGLE_QUOTE` pattern defined as `'` for use in the `USERNAME_WITH_DOMAIN` pattern.</li></ul> | `VMWare/vmware-vcenter/ingest/parser.yml` |
| Added new test files for username parsing. | <ul><li>Added `test_correct_username_1.json` to verify username parsing.</li><li>Added `test_correct_username_2.json` to verify username parsing under different conditions.</li></ul> | `VMWare/vmware-vcenter/tests/test_correct_username_1.json`<br/>`VMWare/vmware-vcenter/tests/test_correct_username_2.json` |

---

<details>
<summary>Tips and commands</summary>

#### Interacting with Sourcery

- **Trigger a new review:** Comment `@sourcery-ai review` on the pull request.
- **Continue discussions:** Reply directly to Sourcery's review comments.
- **Generate a GitHub issue from a review comment:** Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with `@sourcery-ai issue` to create an issue from it.
- **Generate a pull request title:** Write `@sourcery-ai` anywhere in the pull
  request title to generate a title at any time. You can also comment
  `@sourcery-ai title` on the pull request to (re-)generate the title at any time.
- **Generate a pull request summary:** Write `@sourcery-ai summary` anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment `@sourcery-ai summary` on the pull request to
  (re-)generate the summary at any time.
- **Generate reviewer's guide:** Comment `@sourcery-ai guide` on the pull
  request to (re-)generate the reviewer's guide at any time.
- **Resolve all Sourcery comments:** Comment `@sourcery-ai resolve` on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
- **Dismiss all Sourcery reviews:** Comment `@sourcery-ai dismiss` on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  `@sourcery-ai review` to trigger a new review!

#### Customizing Your Experience

Access your [dashboard](https://app.sourcery.ai) to:
- Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
- Change the review language.
- Add, remove or edit custom review instructions.
- Adjust other review settings.

#### Getting Help

- [Contact our support team](mailto:support@sourcery.ai) for questions or feedback.
- Visit our [documentation](https://docs.sourcery.ai) for detailed guides and information.
- Keep in touch with the Sourcery team by following us on [X/Twitter](https://x.com/SourceryAI), [LinkedIn](https://www.linkedin.com/company/sourcery-ai/) or [GitHub](https://github.com/sourcery-ai).

</details>

<!-- Generated by sourcery-ai[bot]: end review_guide -->
author_association: CONTRIBUTOR