Faulty parsing logic in ZScaler ASIM parsers #11848
Description
Describe the bug
Latest ZScaler parsers _ASim_WebSession_ZscalerZIAV04 and _Im_WebSession_ZscalerZIAV06 use parse operation instead of parse-kv for AdditionalExtensions field. This field may not contain all properties required by the parse operation, which causes the operation to not parse anything.
Current parsing logic:
// -- Parse
| parse AdditionalExtensions with
* "rulelabel=" RuleName:string ";"
"ruletype=" ruletype:string ";"
"urlclass=" urlclass:string ";"
"devicemodel=" *
Using parse-kv:
// -- Parse
| parse-kv AdditionalExtensions as (rulelabel: string, ruletype: string, urlclass: string) with (kv_delimiter="=", pair_delimiter=";")
This operator is also preferred by the documentation.