Pipeline Rule not firing

[v_2nas (Nav)]

Hi Folks,
I have created a pipe line rule

rule "Drop4624MachineAccounts"

when
	((to_string($message.EventID) == "4624")) 
	AND 
	(contains(to_string($message.TargetUserName),to_string("$"),true))
then
	drop_message();
end

I am using gelf to ingest windows security log.

I would like to drop specific events, in this case event 4624 whenever TargetUserName field contains a compyter account, A computer account has $ symbol at the end like

PC01$

I have tried using the contain function but it’s not working.

appreciate your assistance in making this work.

[jan (Jan Doberstein)]

what kind of symbol did you look for? You might want to use proper formatting in the forum to make it more clear …

[v_2nas (Nav)]

Hi Jan, I have updated the format. Some how the $ symbol went missing without formatting. Sorry for the inconvenience caused.

[jan (Jan Doberstein)]

you want to escape the $ that should work - but not sure about as I do not have something to test with.

[v_2nas (Nav)]

I have updated the Pipeline rule, however i still see events with computername

rule "Drop4624MachineAccounts"

when
	((to_string($message.EventID) == "4624")) 
	AND 
	(contains(to_string($message.TargetUserName),"/$",true))
then
	drop_message();
end

[jan (Jan Doberstein)]

you escape a character with a \ and not a /

[v_2nas (Nav)]

upon using \ i am seeing syntax error. I tried without " but still, i got syntax error

[jan (Jan Doberstein)]

did you tried a double \\? that might needed. But this is just guessing - not knowledge.

It might be easier to build a regex on this and not using contains.

[v_2nas (Nav)]

Hi jan, i have earlier tried \\$ but that didn’t work either.

Can you share a sample pipeline rule that uses regex function and i will modify it to the need.

[v_2nas (Nav)]

Hi Jan,
this is what worked for me. Thanks for you assistance in getting this sorted out.

 rule "Drop4624MachineAccounts"
when
//    (has_field("EventID") AND (to_string($message.EventID) == "4624"))

// Original - Now Commented
	(has_field("EventID") AND (to_string($message.EventID) == "4624")) AND to_bool(regex("([a-zA-Z0-9])+\\$",to_string($message.TargetUserName)).matches)

then
	drop_message();
end