Regular Expressions 101

SIEM Use Case No 11 - System configuration changes

Open Workspace
  • PCRE (Legacy)
  • Match
0

Regular Expression

/
<EventTypeCode csd-code=\"(?<myEventTypeCode>PPQ-1)\".+?<ActiveParticipant UserID=\"(?<myUserID>\w{0,})\" UserName=\"(?<myUserName>[^\"]*)\" UserIsRequestor=\"true\".*?<RoleIDCode csd-code=\"(?<myRoleCode>\w{1,})\".+?<AuditSourceIdentification.+?AuditSourceID=\"(?<myAuditSourceID>.+?)\">.+?<ParticipantObjectIdentification ParticipantObjectID=\"(?<myParticipantObjectID>\d{1,})[^\"]+?2\.16\.756\.5\.30\.1\.127.+?\" ParticipantObjectTypeCode=\"1\" ParticipantObjectTypeCodeRole=\"1\">
/
gs

Description

No description provided.

Submitted by Anonymous