regex101: PCRE2 (PHP) Match Workspace

Regular Expression

<EventID>4702<\/EventID>|<TimeCreated SystemTime='[^']+'\/>|<Computer>[^<]+<\/Computer>|<Data Name='[^']+'>[^<]+<\/Data>:

New

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4702</EventID><Version>1</Version><Level>0</Level><Task>12804</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2024-12-05T14:59:44.9923272Z'/><EventRecordID>2470365</EventRecordID><Correlation ActivityID='{625186de-46eb-0000-1689-5162eb46db01}'/><Execution ProcessID='1408' ThreadID='1600'/><Channel>Security</Channel><Computer>Host</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-5-20</Data><Data Name='SubjectUserName'> Host $</Data><Data Name='SubjectDomainName'> Host </Data><Data Name='SubjectLogonId'>0x3e4</Data><Data Name='TaskName'>\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask</Data><Data Name='TaskContentNew'>&lt;?xml version="1.0" encoding="UTF-16"?&gt;
&lt;Task version="1.6" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"&gt;
&lt;RegistrationInfo&gt;
&lt;Source&gt;$(@%systemroot%\system32\sppc.dll,-200)&lt;/Source&gt;
&lt;Author&gt;$(@%systemroot%\system32\sppc.dll,-200)&lt;/Author&gt;
&lt;Version&gt;1.0&lt;/Version&gt;
&lt;Description&gt;$(@%systemroot%\system32\sppc.dll,-201)&lt;/Description&gt;
&lt;URI&gt;\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask&lt;/URI&gt;
&lt;SecurityDescriptor&gt;D:P(A;;FA;;;SY)(A;;FA;;;BA)(A;;FA;;;S-1-5-80-123231216-2592883651-3715271367-3753151631-4175906628)(A;;FR;;;S-1-5-87-2912274048-3994893941-1669128114-1310430903-1263774323)&lt;/SecurityDescriptor&gt;
&lt;/RegistrationInfo&gt;
&lt;Triggers&gt;
&lt;CalendarTrigger&gt;
&lt;StartBoundary&gt;2024-12-10T07:54:44Z&lt;/StartBoundary&gt;
&lt;Enabled&gt;true&lt;/Enabled&gt;
&lt;ScheduleByDay&gt;
&lt;DaysInterval&gt;1&lt;/DaysInterval&gt;
&lt;/ScheduleByDay&gt;
&lt;/CalendarTrigger&gt;
&lt;/Triggers&gt;
&lt;Principals&gt;
&lt;Principal id="NetworkService"&gt;
&lt;UserId&gt;S-1-5-20&lt;/UserId&gt;
&lt;RunLevel&gt;LeastPrivilege&lt;/RunLevel&gt;
&lt;/Principal&gt;
&lt;/Principals&gt;
&lt;Settings&gt;
&lt;MultipleInstancesPolicy&gt;IgnoreNew&lt;/MultipleInstancesPolicy&gt;
&lt;DisallowStartIfOnBatteries&gt;true&lt;/DisallowStartIfOnBatteries&gt;
&lt;StopIfGoingOnBatteries&gt;true&lt;/StopIfGoingOnBatteries&gt;
&lt;AllowHardTerminate&gt;false&lt;/AllowHardTerminate&gt;
&lt;StartWhenAvailable&gt;true&lt;/StartWhenAvailable&gt;
&lt;RunOnlyIfNetworkAvailable&gt;false&lt;/RunOnlyIfNetworkAvailable&gt;
&lt;IdleSettings&gt;
&lt;StopOnIdleEnd&gt;true&lt;/StopOnIdleEnd&gt;
&lt;RestartOnIdle&gt;false&lt;/RestartOnIdle&gt;
&lt;/IdleSettings&gt;
&lt;AllowStartOnDemand&gt;true&lt;/AllowStartOnDemand&gt;
&lt;Enabled&gt;true&lt;/Enabled&gt;
&lt;Hidden&gt;true&lt;/Hidden&gt;
&lt;RunOnlyIfIdle&gt;false&lt;/RunOnlyIfIdle&gt;
&lt;DisallowStartOnRemoteAppSession&gt;false&lt;/DisallowStartOnRemoteAppSession&gt;
&lt;UseUnifiedSchedulingEngine&gt;true&lt;/UseUnifiedSchedulingEngine&gt;
&lt;WakeToRun&gt;false&lt;/WakeToRun&gt;
&lt;ExecutionTimeLimit&gt;PT0S&lt;/ExecutionTimeLimit&gt;
&lt;Priority&gt;7&lt;/Priority&gt;
&lt;RestartOnFailure&gt;
&lt;Interval&gt;PT1M&lt;/Interval&gt;
&lt;Count&gt;3&lt;/Count&gt;
&lt;/RestartOnFailure&gt;
&lt;/Settings&gt;
&lt;Actions Context="NetworkService"&gt;
&lt;ComHandler&gt;
&lt;ClassId&gt;{B1AEBB5D-EAD9-4476-B375-9C3ED9F32AFC}&lt;/ClassId&gt;
&lt;Data&gt;&lt;![CDATA[timer]]&gt;&lt;/Data&gt;
&lt;/ComHandler&gt;
&lt;/Actions&gt;
&lt;/Task&gt;</Data><Data Name='ClientProcessStartKey'>26177172834095606</Data><Data Name='ClientProcessId'>2408</Data><Data Name='ParentProcessId'>1368</Data><Data Name='RpcCallClientLocality'>0</Data><Data Name='FQDN'>Host</Data></EventData></Event>

Regular Expressions 101

Regular Expression

Substitution