[Windows]: winlog.user_data.Fqbn Grok fails

### Integration Name

Windows [windows]

### Dataset Name

windows.applocker_packaged_app_execution

### Integration Version

3.6.1

### Agent Version

9.2.6

### Agent Output Type

elasticsearch

### Elasticsearch Version

9.2.5

### OS Version and Architecture

Elastic Cloud

### Software/API Version

_No response_

### Error Message

Provided Grok expressions do not match field value: [CN=F005DA31-7CE1-4D3E-ABEE-08A4AFF4F592\DELLINC.DELLDIGITALDELIVERY\APPX\5.6.3.00]

### Event Original

802004000x2000000000000000173764Microsoft-Windows-AppLocker/Packaged app-ExecutionXXXXXXXX.xxx.xxx.xxx4APPX{a9e18c21-ff8f-43cf-b9fc-db40eed693ba}39(Default Rule) All signed packaged apps81D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({""*\*\*"",0}))))S-1-5-21-796845957-xxxxxxxxx-xxxxxxxxxx-1383522460027DELLINC.DELLDIGITALDELIVERY81CN=F005DA31-7CE1-4D3E-ABEE-08A4AFF4F592\DELLINC.DELLDIGITALDELIVERY\APPX\5.6.3.00DELLINC.DELLDIGITALDELIVERY was allowed to run.InformationInfoMicrosoft-Windows-AppLocker/Packaged app-ExecutionMicrosoft-Windows-AppLocker

### What did you do?

Nothing special

### What did you see?

{
"_index": ".ds-logs-windows.applocker_packaged_app_execution-default-2025.11.10-000001",
"_id": "AZ0pw2dZVWgTRYmwZm4q",
"_version": 1,
"_source": {
"@timestamp": "2026-03-26T10:49:33.071Z",
"agent": {
"ephemeral_id": "23738c89-f68c-4636-89d4-24c367eb7ab4",
"id": "cafb807b-xxxx-xxxx-xxxx-0a3f2060a6e0",
"name": "XXXXXXXX",
"type": "filebeat",
"version": "9.2.5"
},
"data_stream": {
"dataset": "windows.applocker_packaged_app_execution",
"namespace": "default",
"type": "logs"
},
"ecs": {
"version": "8.17.0"
},
"elastic_agent": {
"id": "cafb807b-e844-4fb1-86ac-0a3f2060a6e0",
"snapshot": false,
"version": "9.2.5"
},
"error": {
"message": [
"Provided Grok expressions do not match field value: [CN=F005DA31-7CE1-4D3E-ABEE-08A4AFF4F592\\DELLINC.DELLDIGITALDELIVERY\\APPX\\5.6.3.00]"
]
},
"event": {
"action": "None",
"agent_id_status": "verified",
"category": [
"process"
],
"code": "8020",
"created": "2026-03-26T10:49:34.095Z",
"dataset": "windows.applocker_packaged_app_execution",
"ingested": "2026-03-26T10:49:43Z",
"kind": "pipeline_error",
"original": "802004000x2000000000000000173764Microsoft-Windows-AppLocker/Packaged app-ExecutionXXXXXXXX.xxx.xxx.xxx4APPX{a9e18c21-ff8f-43cf-b9fc-db40eed693ba}39(Default Rule) All signed packaged apps81D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({\"*\\*\\*\",0}))))S-1-5-21-796845957-1844237615-1801674531-1383522460027DELLINC.DELLDIGITALDELIVERY81CN=F005DA31-7CE1-4D3E-ABEE-08A4AFF4F592\\DELLINC.DELLDIGITALDELIVERY\\APPX\\5.6.3.00DELLINC.DELLDIGITALDELIVERY was allowed to run.InformationInfoMicrosoft-Windows-AppLocker/Packaged app-ExecutionMicrosoft-Windows-AppLocker",
"provider": "Microsoft-Windows-AppLocker",
"type": [
"start"
]
},
"host": {
"architecture": "x86_64",
"hostname": "XXXXXXXX",
"id": "355b5ff6-xxxx-xxxx-xxxx-b3b2b7fbf44d",
"ip": [
"xxx.xxx.90.22"
],
"mac": [
"74-86-E2-xx-xx-xx"
],
"name": "XXXXXXXX.xxx.xxx.xxx",
"os": {
"build": "26200.8037",
"family": "windows",
"kernel": "10.0.26100.8036 (WinBuild.160101.0800)",
"name": "Windows 11 Pro",
"platform": "windows",
"type": "windows",
"version": "10.0"
}
},
"input": {
"type": "winlog"
},
"log": {
"level": "information"
},
"message": "DELLINC.DELLDIGITALDELIVERY was allowed to run.",
"tags": [
"preserve_original_event"
],
"user": {
"id": "S-1-5-21-796845957-xxxxxxxxxx-xxxxxxxxxx-138352",
"name": "XXXXXXXX"
},
"winlog": {
"channel": "Microsoft-Windows-AppLocker/Packaged app-Execution",
"computer_name": "XXXXXXXX.xxxxxx.xxx",
"event_id": "8020",
"opcode": "Info",
"process": {
"pid": 1576,
"thread": {
"id": 37580
}
},
"provider_guid": "{cbda4dbf-xxxx-xxxx-xxxx-be14aa540d22}",
"provider_name": "Microsoft-Windows-AppLocker",
"record_id": "173764",
"task": "None",
"user": {
"domain": "XXX",
"identifier": "S-1-5-21-xxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-xxxxxx",
"type": "User"
},
"user_data": {
"Fqbn": "CN=F005DA31-7CE1-4D3E-ABEE-08A4AFF4F592\\DELLINC.DELLDIGITALDELIVERY\\APPX\\5.6.3.00",
"FqbnLength": 81,
"Package": "DELLINC.DELLDIGITALDELIVERY",
"PackageLength": "27",
"PolicyName": "APPX",
"PolicyNameLength": 4,
"RuleId": "{a9e18c21-ff8f-43cf-b9fc-db40eed693ba}",
"RuleName": "(Default Rule) All signed packaged apps",
"RuleNameLength": 39,
"RuleSddl": "D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({\"*\\*\\*\",0}))))",
"RuleSddlLength": 81,
"TargetProcessId": 24600,
"TargetUser": "S-1-5-21-796845957-xxxxxxxxx-xxxxxxxxxx-xxxxxx",
"xml_name": "RuleAndFileData"
}
}
},
"fields": {
"winlog.user_data.RuleId": [
"{a9e18c21-xxxx-xxxx-b9fc-db40eed693ba}"
],
"elastic_agent.version": [
"9.2.5"
],
"event.category": [
"process"
],
"host.os.name.text": [
"Windows 11 Pro"
],
"winlog.user_data.TargetUser": [
"S-1-5-21-796845957-xxxxxxxxxx-xxxxxxxxxx-xxxxxx"
],
"winlog.provider_guid": [
"{cbda4dbf-xxxx-xxxx-xxxx-be14aa540d22}"
],
"winlog.provider_name": [
"Microsoft-Windows-AppLocker"
],
"host.hostname": [
"xxxxxx"
],
"winlog.computer_name": [
"xxxxxx.xxx.xxx.xxx"
],
"host.mac": [
"74-86-E2-xx-xx-xx"
],
"winlog.process.pid": [
1576
],
"agent.name.text": [
"XXXXXXXX"
],
"host.os.version": [
"10.0"
],
"winlog.record_id": [
"173764"
],
"host.os.name": [
"Windows 11 Pro"
],
"log.level": [
"information"
],
"agent.name": [
"XXXXXXXX"
],
"host.name": [
"XXXXXXXX.xxx.xxx.xxx"
],
"event.agent_id_status": [
"verified"
],
"event.kind": [
"pipeline_error"
],
"winlog.user_data.Package": [
"DELLINC.DELLDIGITALDELIVERY"
],
"event.original": [
"802004000x2000000000000000173764Microsoft-Windows-AppLocker/Packaged app-ExecutionXXXXXXXX.xxx.xxx.xxx4APPX{a9e18c21-ff8f-43cf-b9fc-db40eed693ba}39(Default Rule) All signed packaged apps81D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({""*\*\*"",0}))))S-1-5-21-796845957-xxxxxxxxx-xxxxxxxxxx-1383522460027DELLINC.DELLDIGITALDELIVERY81CN=F005DA31-7CE1-4D3E-ABEE-08A4AFF4F592\DELLINC.DELLDIGITALDELIVERY\APPX\5.6.3.00DELLINC.DELLDIGITALDELIVERY was allowed to run.InformationInfoMicrosoft-Windows-AppLocker/Packaged app-ExecutionMicrosoft-Windows-AppLocker"
],
"host.os.type": [
"windows"
],
"user.id": [
"S-1-5-21-796845957-1844237615-1801674531-138352"
],
"winlog.user_data.TargetProcessId": [
24600
],
"input.type": [
"winlog"
],
"data_stream.type": [
"logs"
],
"tags": [
"preserve_original_event"
],
"winlog.user_data.PolicyNameLength": [
4
],
"host.architecture": [
"x86_64"
],
"event.provider": [
"Microsoft-Windows-AppLocker"
],
"event.code": [
"8020"
],
"agent.id": [
"cafb807b-e844-4fb1-86ac-0a3f2060a6e0"
],
"ecs.version": [
"8.17.0"
],
"event.created": [
"2026-03-26T10:49:34.095Z"
],
"agent.version": [
"9.2.5"
],
"host.os.family": [
"windows"
],
"winlog.user_data.PolicyName": [
"APPX"
],
"winlog.user_data.xml_name": [
"RuleAndFileData"
],
"winlog.process.thread.id": [
37580
],
"user.name": [
"XXXXXXXX"
],
"host.os.build": [
"26200.8037"
],
"winlog.user.type": [
"User"
],
"host.ip": [
"xxx.xxx.90.22"
],
"agent.type": [
"filebeat"
],
"winlog.user_data.PackageLength": [
"27"
],
"event.module": [
"windows"
],
"host.os.kernel": [
"10.0.26100.8036 (WinBuild.160101.0800)"
],
"winlog.user_data.RuleSddlLength": [
81
],
"elastic_agent.snapshot": [
false
],
"host.id": [
"355b5ff6-xxxx-xxxx-xxxx-b3b2b7fbf44d"
],
"winlog.user.identifier": [
"S-1-5-21-xxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-xxxxxx"
],
"winlog.user_data.RuleName": [
"(Default Rule) All signed packaged apps"
],
"winlog.task": [
"None"
],
"winlog.user.domain": [
"WIN"
],
"elastic_agent.id": [
"cafb807b-xxxx-xxxx-xxxx-0a3f2060a6e0"
],
"data_stream.namespace": [
"default"
],
"winlog.user_data.RuleNameLength": [
39
],
"message": [
"DELLINC.DELLDIGITALDELIVERY was allowed to run."
],
"winlog.event_id": [
"8020"
],
"winlog.user_data.FqbnLength": [
81
],
"winlog.user_data.RuleSddl": [
"D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({\"*\\*\\*\",0}))))"
],
"event.action": [
"None"
],
"event.ingested": [
"2026-03-26T10:49:43.000Z"
],
"@timestamp": [
"2026-03-26T10:49:33.071Z"
],
"winlog.channel": [
"Microsoft-Windows-AppLocker/Packaged app-Execution"
],
"host.os.platform": [
"windows"
],
"winlog.user_data.Fqbn": [
"CN=F005DA31-xxxx-xxxx-xxxx-08A4AFF4F592\\DELLINC.DELLDIGITALDELIVERY\\APPX\\5.6.3.00"
],
"error.message": [
"Provided Grok expressions do not match field value: [CN=F005DA31-xxxx-xxxx-xxxx-08A4AFF4F592\\DELLINC.DELLDIGITALDELIVERY\\APPX\\5.6.3.00]"
],
"data_stream.dataset": [
"windows.applocker_packaged_app_execution"
],
"event.type": [
"start"
],
"winlog.opcode": [
"Info"
],
"agent.ephemeral_id": [
"23738c89-f68c-4636-89d4-24c367eb7ab4"
],
"event.dataset": [
"windows.applocker_packaged_app_execution"
],
"user.name.text": [
"XXXXXXXX"
]
}
}

### What did you expect to see?

The @custom ingest pipeline doesn't run because the failure in the main ingest pipeline

### Anything else?

_No response_