Group event_message(?P<event_message>A user account was unlocked\.) A user account was unlockedthe literal text A user account was unlocked (case sensitive) \.the literal . (4610 / 568 / 2E16)
\s+any whitespace character, repeated at least once
Subject:the literal text Subject: (case sensitive) \s+any whitespace character, repeated at least once
Security ID:the literal text Security ID: (case sensitive) \s+any whitespace character, repeated at least once
Group subject_security_id(?P<subject_security_id>.*?) .*?any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Account Name:the literal text Account Name: (case sensitive) \s+any whitespace character, repeated at least once
Group subject_account_name(?P<subject_account_name>.*?) .*?any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Account Domain:the literal text Account Domain: (case sensitive) \s+any whitespace character, repeated at least once
Group subject_account_domain(?P<subject_account_domain>.*?) .*?any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Logon ID:the literal text Logon ID: (case sensitive) \s+any whitespace character, repeated at least once
Group subject_logon_id(?P<subject_logon_id>.*?) .*?any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Target Account:the literal text Target Account: (case sensitive) \s+any whitespace character, repeated at least once
Security ID:the literal text Security ID: (case sensitive) Group target_security_id(?P<target_security_id>.*?) .*?any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Account Name:the literal text Account Name: (case sensitive) \s+any whitespace character, repeated at least once
Group target_account_name(?P<target_account_name>.*?) .*?any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Account Domain:the literal text Account Domain: (case sensitive) \s+any whitespace character, repeated at least once
Group target_account_domain(?P<target_account_domain>.*) .*any character (except for line terminators), repeated any number of times
g modifier: global. Finds all matches instead of stopping after the first