Spell the modifier json_meta_contains on sid 5017897

[NRGLine4Sec]

The rule excludes two applications with

json_meta_content:!".ApplicationDisplayName",Power|20|BI,OneNoteLegacyClient; json_contains;

and json_contains is not the modifier json_meta_content reads. rules.c line 2231 sets json_content_strstr[json_content_count-1], the last json_content, whatever keywords sit between the two; the meta branch reads json_meta_contains at line 2294.

So the modifier lands on json_content:!".UserId","app@sharepoint", three options earlier, and turns that exclusion into a substring test, while the application list it was written for is compared whole.

Two consequences, both measured against Sagan built from 3b9b0fa with 200 events per case, the count the rule's after needs:

.UserId or .ApplicationDisplayName ships patched
an ordinary user, an unlisted app alert alert
UserId myapp@sharepoint.com silent alert
ApplicationDisplayName "Power BI Desktop" alert silent
ApplicationDisplayName "Power BI" silent silent

The second row is a user excluded for holding app@sharepoint inside a longer name. The third is the exclusion the rule was written for not applying to a value that carries the listed one.

The last row is the case that works today and still works: the exclusion bites on an exact match either way.

Three other rules in the corpus exclude a list of application or method names, and all three write json_meta_contains.

rev incremented.