Regular Expressions 101

Explanation

Pro

(?ms)applies the following effective flags to the remainder of the pattern: gms

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

s modifier: single line. Allows a dot to match line terminators

Messagethe literal text Message (case sensitive)

\=the literal = (61₁₀ / 75₈ / 3D₁₆)

\"the literal " (34₁₀ / 42₈ / 22₁₆)

Group Message(?<Message>.+)

.+any character, repeated at least once

\s+any whitespace character, repeated at least once

SIDthe literal text SID (case sensitive)

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Match Information

Detailed match information will be displayed here automatically.

Quick Reference

25 tokens

Regular Expression

(?ms)Message\=\"(?<Message>.+)\s+SID

Message="Internal event: Function ldap_search entered.
SID: S-1-5-18
Source IP: 127.0.0.1:25855
Operation identifier: 680571
Data1:
Data2: 2796807187
Data3:
Data4:"

Extraction

Message="Internal event: Function ldap_search entered.
SID: S-1-5-18
Source IP: 127.0.0.1:25855
Operation identifier: 680571
Data1:
Data2: 2796807187
Data3:
Data4:"