$re = '/^.*?\bMicrosoft-Windows-Security-Auditing[^\S\r\n]+4740[^\S\r\n]+.*(?:\r?\n(?!Subject:).*)*\r?\nSubject:(?:\r?\n(?![^\S\r\n]*Account Name:).*)*\r?\n.*Account Name:[^\S\r\n]*(\w+)\$(?:\r?\n(?!Account).*)*\r?\nAccount.*(?:\r?\n(?![^\S\rn]*Account Name:).*)*\r?\n.*Account Name:[^\S\r\n]*(\S+)/m';
$str = 'Information 22.12.2020 21:28:46 Microsoft-Windows-Security-Auditing 4740 User Account Management "A user account was locked out.
Subject:
Security ID: SYSTEM
Account Name: SERVER23$
Account Domain: DOMAIN
Logon ID: 0x3E7
Account That Was Locked Out:
Security ID: domain\\firstname.lastname
Account Name: firstname.lastname
Information 22.12.2020 21:28:46 Microsoft-Windows-Security-Auditing 4740 User Account Management "A user account was locked out.
Subject:
Security ID: SYSTEM
Account Name: SERVER23$
Account Domain: DOMAIN
Logon ID: 0x3E7
Account That Was Locked Out:
Security ID: domain\\john.doe
Account Name: john.doe
Information 22.12.2020 21:28:46 Microsoft-Windows-Security-Auditing 4740 User Account Management "A user account was locked out.
Subject:
Security ID: SYSTEM
Account Name: SERVER23$
Account Domain: DOMAIN
Logon ID: 0x3E7
Account That Was Locked Out:
Security ID: domain\\adon.cekaj
Account Name: adon.cekaj
This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.
This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.
Ticket options, encryption types, and failure codes are defined in RFC 4120."
Information 22.12.2020 21:34:41 Microsoft-Windows-Security-Auditing 4740 User Account Management "A user account was locked out.
Subject:
Security ID: SYSTEM
Account Name: SERVER23$
Account Domain: DOMAIN
Logon ID: 0x3E7
Account That Was Locked Out:
Security ID: DOMAIN\\simon.brandlaub
Account Name: simon.brandlaub
Information 22.12.2020 12:39:37 Microsoft-Windows-Security-Auditing 4740 User Account Management "A user account was locked out.
Subject:
Security ID: SYSTEM
Account Name: SERVER23$
Account Domain: DOMAIN
Logon ID: 0x3E7
Account That Was Locked Out:
Security ID: DOMAIN\\robin.hutmacher
Account Name: robin.hutmacher
';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php