From adb8d3339f71f066a67053d79f37cb17883118e5 Mon Sep 17 00:00:00 2001
From: Brian Grabau <brian_grabau@cargill.com>
Date: Thu, 14 Nov 2024 10:07:06 -0600
Subject: [PATCH 1/2] Azure Interactive signin has bad json string {PII
 Removed}

---
 .../event_hub_audit_azure.event_hub_interactive_signin.conf      | 1 +
 1 file changed, 1 insertion(+)

diff --git a/config/processors/event_hub_audit_azure.event_hub_interactive_signin.conf b/config/processors/event_hub_audit_azure.event_hub_interactive_signin.conf
index 3464a31f..e921b854 100644
--- a/config/processors/event_hub_audit_azure.event_hub_interactive_signin.conf
+++ b/config/processors/event_hub_audit_azure.event_hub_interactive_signin.conf
@@ -18,6 +18,7 @@ filter {
       "message", '\]"', ']',
       "message", '\}"', '}',
       "message", '"\{', '{'
+      "message", '{PII Removed}', '"PII Removed"'
     ]
   }
    json {

From 43505353605e83b1a5b2be6a29035e556ed7d29f Mon Sep 17 00:00:00 2001
From: Brian Grabau <brian_grabau@cargill.com>
Date: Thu, 14 Nov 2024 10:19:30 -0600
Subject: [PATCH 2/2] forgot comma

---
 .../event_hub_audit_azure.event_hub_interactive_signin.conf     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/processors/event_hub_audit_azure.event_hub_interactive_signin.conf b/config/processors/event_hub_audit_azure.event_hub_interactive_signin.conf
index e921b854..111fec27 100644
--- a/config/processors/event_hub_audit_azure.event_hub_interactive_signin.conf
+++ b/config/processors/event_hub_audit_azure.event_hub_interactive_signin.conf
@@ -17,7 +17,7 @@ filter {
       "message", '"\[', '[',
       "message", '\]"', ']',
       "message", '\}"', '}',
-      "message", '"\{', '{'
+      "message", '"\{', '{',
       "message", '{PII Removed}', '"PII Removed"'
     ]
   }