Split userPrincipalName in Azure Sentinel Playbook

Occasional Contributor

Please could someone give me some pointers on how I can split a userPrincipalName from to


Essentially I want to extract everything before the '@' symbol.


I attempted using this syntax however it is not working, so any pointers would be greatly appreciated. 



split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '@') 



This leaves me with ["", ""], how can I escape the ""


3 Replies

@TS-noodlemctwoodle I think if you append "[0]" to end of your split you will only get the username.

@Gary Bushey 


The template language expression 'split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '@')['0']' cannot be evaluated because property '0' cannot be selected. Array elements can only be selected using an integer index. 


This isnt possible, I have tried many variations of the same

split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '@'),['0']'

split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '@')(['0']')

best response confirmed by TS-noodlemctwoodle (Occasional Contributor)

@Gary Bushey 


Thanks for the pointers, this is the working Expression.


split(triggerBody()?['object']?['properties']?['owner']?['userPrincipalName'], '')[0]