Username Generalization Playbook

B.Jones279846 — Wed, 06 May 2026 19:53:49 GMT

Hey all, i'm hoping that someone has already started something like this and can get me a few steps past the starting line but as we know, in a corporate environment, there are various ways that usernames come across (abc123, first.last, domain/abc123, domain/first.last, fqdn....etc) from different log sources. This creates complexity for playbooks and manual effort to try and keep up with what log source sends it across in what way.

Does anyone have a playbook started that would generalize them? endgoal would be to generalize it based on what our enterprise username format is and remove any of the junk on either side of it based on whatever the log source sent through. I'm not real versed in creating playbooks yet so any help would be appreciated.

Assuming this works out well, we'd like to expand out and generalize other things like hostname and who knows what else would be benefical.

topic Username Generalization Playbook in Cortex XSIAM Discussions

Username Generalization Playbook