Regular Expressions 101

Community Patterns

LogRhythm - Parser - Symantec Endpoint Protection - Agent Activity Logging

0

Regular Expression
PCRE (PHP <7.3)

/
(Site\:(?<vendorinfo>[\s|\w]*)\,)?(Server\sName\:(?<dname>[\s|\w]*)\,)?(Domain\sName\:(?<group>[\s|\w]*)\,)((?<reason>[\s|\w]*)\,)((?<sname>[\s|\w|\.|\-|_|\d]*)\,)((?<login>[[\s|\w|\.|\-|_|\d]*)\,)((?<domain>[[\s|\w|\.|\-|_|\d]*))
/
gm

Description

This parser has been built in order to parse the Symantec Endpoint Protection and specifically for Agent Activity Logging. If you would to know more about the type of Symantec logging, please click here.

Submitted by anonymous - 4 years ago