Part of #51556

https://eql.readthedocs.io/en/latest/query-guide/functions.html#match

Requires one field (or other expression), and at least one regular expression, which can't be null. This should be easy with a surrogate function that uses RLike

null behavior
if the first argument is null, this returns null