03/29/2023 07:24 AM
Hello,
Could not find any examples in the documentation to show how to use SQL for account correlation.
The target system has accounts in this format: email+build@domain.com.
What I need to do is remove the +build from the account name so it's just email address left, then match it with user.email. How can I achieve this?
Solved! Go to Solution.
03/29/2023 08:29 AM
You can try this:
CONCAT(LEFT(accounts.name, LOCATE('+', accounts.name)-1),
SUBSTRING(accounts.name, LOCATE('@', accounts.name))) = users.email
Test it in data analyzer first for one of the users and if its displaying the result as expected, you can use it in Advanced Config in User Account Correlation rule at the Endpoint level.
03/29/2023 08:44 AM
Thank you Ishan, that worked perfect.