After figuring out what was going on, I figured I would feed this back up.
The current package has a bug in the extraction User_as_user. The REPORT pointing to the extraction cannot work, as all of the transforms have to be lower case. As a result, this REPORT in props doesn't work, and the resulting user field is essentially returning the same thing as if there was a FIELDALIAS instead linking User to user, including any "domain name\username" format.
Props.conf has:
REPORT-user_for_sysmon = User_as_user
and in Transforms.conf
[User_as_user]
SOURCE_KEY = User
REGEX = (?:[^\\]+\\)?(.+)
FORMAT = user::"$1"
To fix this, change User_as_user --> user_as_user in both places:
Props.conf:
REPORT-user_for_sysmon = user_as_user
and in Transforms.conf
[user_as_user]
SOURCE_KEY = User
REGEX = (?:[^\\]+\\)?(.+)
FORMAT = user::"$1"
