SOLVED

Split userPrincipalName in Azure Sentinel Playbook

Brass Contributor

Please could someone give me some pointers on how I can split a userPrincipalName from user.name@doamin.com to user.name?

 

Essentially I want to extract everything before the '@' symbol.

 

I attempted using this syntax however it is not working, so any pointers would be greatly appreciated. 

 

 

split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '@') 

 

 

This leaves me with ["user.name", "domain.com"], how can I escape the "domain.com"

 

3 Replies

@TS-noodlemctwoodle I think if you append "[0]" to end of your split you will only get the username.

@Gary Bushey 

 

The template language expression 'split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '@')['0']' cannot be evaluated because property '0' cannot be selected. Array elements can only be selected using an integer index. 

 

This isnt possible, I have tried many variations of the same

split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '@'),['0']'

split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '@')(['0']')

best response confirmed by TS-noodlemctwoodle (Brass Contributor)
Solution

@Gary Bushey 

 

Thanks for the pointers, this is the working Expression.

 

split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '@domain.com')[0]
1 best response

Accepted Solutions
best response confirmed by TS-noodlemctwoodle (Brass Contributor)
Solution

@Gary Bushey 

 

Thanks for the pointers, this is the working Expression.

 

split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '@domain.com')[0]

View solution in original post