Forum Discussion
Solved
Split userPrincipalName in Azure Sentinel Playbook
Please could someone give me some pointers on how I can split a userPrincipalName from mailto:user.name@doamin.com to user.name? Essentially I want to extract everything before the '@' symbol. ...
Thanks for the pointers, this is the working Expression.
split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '@domain.com')[0]
TS-noodlemctwoodle I think if you append "[0]" to end of your split you will only get the username.
The template language expression 'split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '@')['0']' cannot be evaluated because property '0' cannot be selected. Array elements can only be selected using an integer index.
This isnt possible, I have tried many variations of the same
split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '@'),['0']'
split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '@')(['0']')
Thanks for the pointers, this is the working Expression.
split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '@domain.com')[0]