05-06-2026 12:53 PM
Hey all, i'm hoping that someone has already started something like this and can get me a few steps past the starting line but as we know, in a corporate environment, there are various ways that usernames come across (abc123, first.last, domain/abc123, domain/first.last, fqdn....etc) from different log sources. This creates complexity for playbooks and manual effort to try and keep up with what log source sends it across in what way.
Does anyone have a playbook started that would generalize them? endgoal would be to generalize it based on what our enterprise username format is and remove any of the junk on either side of it based on whatever the log source sent through. I'm not real versed in creating playbooks yet so any help would be appreciated.
Assuming this works out well, we'd like to expand out and generalize other things like hostname and who knows what else would be benefical.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
