Regular Expressions 101

Security ID: the literal text Security ID: (case sensitive)

Group security_id(?<security_id>[\S]+)

Character Class[\S]+

+matches at least one character from the set below:

\Sany non-whitespace character

Account Name: the literal text Account Name: (case sensitive)

Group account_name(?<account_name>[\S]+)

Character Class[\S]+

+matches at least one character from the set below:

\Sany non-whitespace character

Account Domain: the literal text Account Domain: (case sensitive)

Group account_domain(?<account_domain>[\S]+)

Character Class[\S]+

+matches at least one character from the set below:

\Sany non-whitespace character

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Detailed match information will be displayed here automatically.

Search reference

Regular Expression

Security ID: (?<security_id>[\S]+) Account Name: (?<account_name>[\S]+) Account Domain: (?<account_domain>[\S]+)

New

Message=network share object was checked to see whether client can be granted desired access. Subject: Security ID: EMEA\xxxx.xxxxxx Account Name: xxxx.xxxxxxx Account Domain: EMEA Logon ID: xxxxxxxxxx Network Information: Object Type: File Source Address: xx.xx.xx.xxx Source Port: xxxxx Share Information: Share Name: \*\XX_XX_6_1

Regular Expression

Extraction