import java.util.regex.Matcher;
import java.util.regex.Pattern;
public class Example {
public static void main(String[] args) {
final String regex = "(New Logon:)(.*\\n+.*\\n+.|[\\r\\n\\w:\\s-]+)Account Name:\\s+((?i)\\b(?!System)[a-zA-Z0-9]+)";
final String string = "Log Name: Security\n"
+ "Source: Microsoft-Windows-Security-Auditing\n"
+ "Date: 05/05/2021 15:02:41\n"
+ "Event ID: 4624\n"
+ "Task Category: Logon\n"
+ "Level: Information\n"
+ "Keywords: Audit Success\n"
+ "User: N/A\n"
+ "Computer: WebServer04\n"
+ "Description:\n"
+ "An account was successfully logged on.\n\n"
+ "Subject:\n"
+ " Security ID: SYSTEM\n"
+ " Account Name: WEBSERVER04$\n"
+ " Account Domain: WORKGROUP\n"
+ " Logon ID: 0x3E7\n\n"
+ "Logon Information:\n"
+ " Logon Type: 7\n"
+ " Restricted Admin Mode: -\n"
+ " Virtual Account: No\n"
+ " Elevated Token: No\n\n"
+ "Impersonation Level: Impersonation\n\n"
+ "New Logon:\n"
+ " Security ID: WEBSERVER04\\mcanbaz\n"
+ " Account Name: mcanbaz\n"
+ " Account Domain: WEBSERVER04\n"
+ " Logon ID: 0x19CCD80\n"
+ " Linked Logon ID: 0x19CCD62\n"
+ " Network Account Name: -\n"
+ " Network Account Domain: -\n"
+ " Logon GUID: {00000000-0000-0000-0000-000000000000}\n\n"
+ "Process Information:\n"
+ " Process ID: 0x614\n"
+ " Process Name: C:\\Windows\\System32\\svchost.exe\n\n"
+ "Network Information:\n"
+ " Workstation Name: WEBSERVER04\n"
+ " Source Network Address: 192.168.0.10\n"
+ " Source Port: 0\n\n"
+ "Detailed Authentication Information:\n"
+ " Logon Process: User32 \n"
+ " Authentication Package: Negotiate\n"
+ " Transited Services: -\n"
+ " Package Name (NTLM only): -\n"
+ " Key Length: 0\n\n"
+ "This event is generated when a logon session is created. It is generated on the computer that was accessed.\n\n"
+ "The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\n"
+ "The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\n"
+ "The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\n"
+ "The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\n"
+ "The impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\n"
+ "The authentication information fields provide detailed information about this specific logon request.\n"
+ " - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n"
+ " - Transited services indicate which intermediate services have participated in this logon request.\n"
+ " - Package name indicates which sub-protocol was used among the NTLM protocols.\n"
+ " - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\n"
+ "Event Xml:\n"
+ "<Event xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\">\n"
+ " <System>\n"
+ " <Provider Name=\"Microsoft-Windows-Security-Auditing\" Guid=\"{54849625-5478-4994-a5ba-3e3b0328c30d}\" />\n"
+ " <EventID>4624</EventID>\n"
+ " <Version>2</Version>\n"
+ " <Level>0</Level>\n"
+ " <Task>12544</Task>\n"
+ " <Opcode>0</Opcode>\n"
+ " <Keywords>0x8020000000000000</Keywords>\n"
+ " <TimeCreated SystemTime=\"2021-05-05T12:02:41.872791700Z\" />\n"
+ " <EventRecordID>111399</EventRecordID>\n"
+ " <Correlation ActivityID=\"{80931da6-4143-0001-071f-93804341d701}\" />\n"
+ " <Execution ProcessID=\"680\" ThreadID=\"96\" />\n"
+ " <Channel>Security</Channel>\n"
+ " <Computer>WebServer04</Computer>\n"
+ " <Security />\n"
+ " </System>\n"
+ " <EventData>\n"
+ " <Data Name=\"SubjectUserSid\">S-1-5-18</Data>\n"
+ " <Data Name=\"SubjectUserName\">WEBSERVER04$</Data>\n"
+ " <Data Name=\"SubjectDomainName\">WORKGROUP</Data>\n"
+ " <Data Name=\"SubjectLogonId\">0x3e7</Data>\n"
+ " <Data Name=\"TargetUserSid\">S-1-5-21-2305414523-2991885378-3430239152-1000</Data>\n"
+ " <Data Name=\"TargetUserName\">mcanbaz</Data>\n"
+ " <Data Name=\"TargetDomainName\">WEBSERVER04</Data>\n"
+ " <Data Name=\"TargetLogonId\">0x19ccd80</Data>\n"
+ " <Data Name=\"LogonType\">7</Data>\n"
+ " <Data Name=\"LogonProcessName\">User32 </Data>\n"
+ " <Data Name=\"AuthenticationPackageName\">Negotiate</Data>\n"
+ " <Data Name=\"WorkstationName\">WEBSERVER04</Data>\n"
+ " <Data Name=\"LogonGuid\">{00000000-0000-0000-0000-000000000000}</Data>\n"
+ " <Data Name=\"TransmittedServices\">-</Data>\n"
+ " <Data Name=\"LmPackageName\">-</Data>\n"
+ " <Data Name=\"KeyLength\">0</Data>\n"
+ " <Data Name=\"ProcessId\">0x614</Data>\n"
+ " <Data Name=\"ProcessName\">C:\\Windows\\System32\\svchost.exe</Data>\n"
+ " <Data Name=\"IpAddress\">192.168.10.25</Data>\n"
+ " <Data Name=\"IpPort\">0</Data>\n"
+ " <Data Name=\"ImpersonationLevel\">%%1833</Data>\n"
+ " <Data Name=\"RestrictedAdminMode\">-</Data>\n"
+ " <Data Name=\"TargetOutboundUserName\">-</Data>\n"
+ " <Data Name=\"TargetOutboundDomainName\">-</Data>\n"
+ " <Data Name=\"VirtualAccount\">%%1843</Data>\n"
+ " <Data Name=\"TargetLinkedLogonId\">0x19ccd62</Data>\n"
+ " <Data Name=\"ElevatedToken\">%%1843</Data>\n"
+ " </EventData>\n"
+ "</Event>";
final Pattern pattern = Pattern.compile(regex, Pattern.MULTILINE);
final Matcher matcher = pattern.matcher(string);
while (matcher.find()) {
System.out.println("Full match: " + matcher.group(0));
for (int i = 1; i <= matcher.groupCount(); i++) {
System.out.println("Group " + i + ": " + matcher.group(i));
}
}
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Java, please visit: https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html