How to define the same index array

I have an Azure log that contains multiple policy validations. Each validation generates an object inside an array with rule_name and result.

All this information is parsed in SecOps as security_result, so now I have a security_result field with two or more objects.

For example:

security_result: (2)

0:
rule_name: "rule_1"
result: "success"

1:
rule_name: "rule_2"
result: "notApplied"

How can I, in Search and YARA-L, perform a validation where rule_name = "rule_1" and the result of that policy is "notApplied", without using a predefined index? The position of rule_name = "rule_1" can change depending on the log.