(?=[^A]*(?:ASM:|A.*ASM:))^.*?\s+ASM:"(?P<asm_request_status>[^"]+)","(?P<asm_timestamp>\d+\-\d+\-\d+\s+\d+:\d+:\d+)","(?P<asm_severity>\w+)","(?P<asm_attack_types>[^"]*)","(?P<asm_violation>[^"]*)","(?P<asm_support_id>\d+)","(?P<asm_security_policy>[^"]+)","(?P<asm_src_client_ip>[^"]+)","(?P<asm_src_xffclient_ip>[^"]+)","(?P<asm_protocol>[^"]+)","(?P<asm_http_method>[^"]+)","(?P<asm_dst_server_ip>[^"]+)","(?P<asm_dst_server_port>[^"]+)"(?:,"(?P<asm_requested_url>[^"]+)","(?P<asm_response_code>\d+)","(?P<asm_loadbalancer>[^"]+)","(?P<asm_ip_address_intelligence>[^"]+)","(?P<asm_sub_violation>[^"]*)","(?P<asm_violation_rating>[^"]+)"(?:,"(?P<asm_violation_details>[^"]+?(?P<asm_violation_name><viol_name>.*?<\/viol_name>)+?.*?(?P<asm_violation_context><context>.*?<\/context>)*.*?(?P<asm_policy_param><param_name_pattern>.*?<\/param_name_pattern>)*[^"]+))?)?