Apostrophes in usernames show as both internal and external activity

Products

• CASB Securlet SAAS
• CASB Security Advanced
• CASB Security Premium
• CASB Security Standard

Issue/Introduction

Internal users with apostrophes in their usernames show as both internal/external user activity. 

For example dan'[email protected] or bruce.o'[email protected] will show as both internal/external user activity for logging into the corporate O365 account.

 

 

Environment

CloudSOC 3.157 

Cause

It looks like the apostrophe is being interpreted not as text but as a delimiter or special character. 

For dan'[email protected], the user name was escaped with a \u and then a NULL (0x00) and then the apostrophe ' is getting converted to a 0x27.  

Therefore dan'[email protected] is turning into dan[[email protected]|mailto:[email protected]].  

From this website: https://www.ascii-code.com/, you'll see 00 for NUL and 27 for the apostrophe.

Resolution

Fix will be available in the 3.158 update, to be released on April 20, 2023