What Changed

Updated both VMware vCenter ASIM authentication parsers to properly cast DvcId field from dynamic to string type using tostring() function.

Parser Impact

The DvcId field was incorrectly typed as dynamic when extracted via split(PreEventString, " “)[3]. This type mismatch caused queries referencing DvcId to fail or return unexpected results. The fix ensures proper string typing for both login and logout event processing in:

  • ASimAuthenticationVMwareVCenter (unfiltered parser)
  • vimAuthenticationVMwareVCenter (filtering parser)

No change to normalised field names or filter logic — safe for existing detections using this parser. However, deployments experiencing DvcId query failures will now function correctly.

Affected Files

Parsers/ASimAuthentication/ARM/ASimAuthenticationVMwareVCenter/ASimAuthenticationVMwareVCenter.json
Parsers/ASimAuthentication/ARM/vimAuthenticationVMwareVCenter/vimAuthenticationVMwareVCenter.json
Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationVMwareVCenter.md
Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationVMwareVCenter.md
Parsers/ASimAuthentication/Parsers/ASimAuthenticationVMwareVCenter.yaml
Parsers/ASimAuthentication/Parsers/vimAuthenticationVMwareVCenter.yaml