Forum Discussion
Solved
Split userPrincipalName in Azure Sentinel Playbook
Please could someone give me some pointers on how I can split a userPrincipalName from user.name@doamin.com to user.name?
Essentially I want to extract everything before the '@' symbol.
I attempted using this syntax however it is not working, so any pointers would be greatly appreciated.
split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '@')
This leaves me with ["user.name", "domain.com"], how can I escape the "domain.com"
Thanks for the pointers, this is the working Expression.
split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '@domain.com')[0]
TS-noodlemctwoodle I think if you append "[0]" to end of your split you will only get the username.
The template language expression 'split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '@')['0']' cannot be evaluated because property '0' cannot be selected. Array elements can only be selected using an integer index.
This isnt possible, I have tried many variations of the same
split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '@'),['0']'
split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '@')(['0']')
Thanks for the pointers, this is the working Expression.
split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '@domain.com')[0]
