Regex

• /: The forward slashes at the beginning and end are delimiters. They mark the start and end of the regular expression pattern.
• \\$: The dollar sign ($) usually has a special meaning in regular expressions: it signifies the end of a string (or the end of a line in multiline mode). However, here it is preceded by a backslash (\\). This backslash is an escape character. It tells the regex engine to treat the following dollar sign as a literal character, not as the special end-of-string anchor.
• $: As mentioned before, the dollar sign without an escape character would normally match the end of a string. Here it's escaped, so it's just looking for a dollar sign.
• $ (at the end): This is the special character $, which is not escaped, acting as the end-of-string anchor.

(explanation courtesy of Gemini)

This is the error I am getting : 

 

tokenizing: unable to tokenize: invalid char escape

It is recommended to use single quotes with re.regex 

@cmmartin_google summed it up neatly above but I will share a blog I wrote on re.regex for future reference. I took a look at trying to use double quotes for something rather than the backtick, but the last 4 paragraphs hopefully provide a nice visual why going with backticks is going to be a better way forward...

https://www.googlecloudcommunity.com/gc/Community-Blog/New-to-Google-SecOps-Matching-with-Regular-Expression-Functions/ba-p/724857

Hello all,
​@anurag.q.singh  Google SecOps recently released a new function that can validate whether a string ends with a specific character, such as “$”

strings.ends_with(value, suffix)

events:
    $e.metadata.product_event_type = "4723" or $e.metadata.product_event_type = "4724"
    $e.metadata. vendor_name = "Microsoft"
    $e.target.user.userid = $targetUser
    $e.principal.user.userid = $sourceUser
    $e.principal.hostname = $hostname
    not strings.ends_with($sourceUser, "$")

You can find the documentation here.

Hi ​@anurag.q.singh,

As alternative to strings.ends_with, you could put the value in a ‘[‘ ‘]’ which should work, for example:

principal.user.user.id = /test[$]$/

Kind Regards,

Ayman