regex101: PCRE2 (PHP) Match Workspace

Pro

1st Alternative(EventCode=(4624|4634|4625)\X*Account Name:(\s+.*\.adm.*))

Group 1(EventCode=(4624|4634|4625)\X*Account Name:(\s+.*\.adm.*))

EventCode=the literal text EventCode= (case sensitive)

Group 2(4624|4634|4625)

1st Alternative4624

4624the literal text 4624

2nd Alternative4634

4634the literal text 4634

3rd Alternative4625

4625the literal text 4625

\X*one Unicode extended grapheme cluster, repeated any number of times

Account Name:the literal text Account Name: (case sensitive)

Group 3(\s+.*\.adm.*)

\s+any whitespace character, repeated at least once

.*any character (except for line terminators), repeated any number of times

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

admthe literal text adm (case sensitive)

.*any character (except for line terminators), repeated any number of times

2nd Alternative(EventCode=(4659|4663|5145)\X*Object Name:(\s+.*Test_share.*))

Group 4(EventCode=(4659|4663|5145)\X*Object Name:(\s+.*Test_share.*))

EventCode=the literal text EventCode= (case sensitive)

Group 5(4659|4663|5145)

1st Alternative4659

4659the literal text 4659

2nd Alternative4663

4663the literal text 4663

3rd Alternative5145

5145the literal text 5145

\X*one Unicode extended grapheme cluster, repeated any number of times

Object Name:the literal text Object Name: (case sensitive)

Group 6(\s+.*Test_share.*)

\s+any whitespace character, repeated at least once

.*any character (except for line terminators), repeated any number of times

Test_sharethe literal text Test_share (case sensitive)

.*any character (except for line terminators), repeated any number of times

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

25 tokens

Regular Expression

(EventCode=(4624|4634|4625)\X*Account Name:(\s+.*\.adm.*))|(EventCode=(4659|4663|5145)\X*Object Name:(\s+.*Test_share.*))

New

05/03/2024 02:46:06 PM
LogName=Security
EventCode=4624
EventType=0
ComputerName=myhost
SourceName=Microsoft Windows security auditing.
Type=Information
RecordNumber=0
Keywords=Audit Success
TaskCategory=Logon
OpCode=Info
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		DOMAIN\user.adm
	Account Name:		user.adm
	Account Domain:		DOMAIN.LOCAL
	Logon ID:		0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	
	Source Port:		63095

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0



04/30/2024 04:49:05 PM
LogName=Security
EventCode=4659
EventType=0
ComputerName=MyHost
SourceName=Microsoft Windows security auditing.
Type=Information
RecordNumber=0
Keywords=Audit Success
TaskCategory=File System
OpCode=Info
Message=A handle to an object was requested with intent to delete.

Subject:
	Security ID:		myuser
	Account Name:		myuser
	Account Domain:		Domain
	Logon ID:		0x580B3D59

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	D:\Test_share\prova.txt
	Handle ID:	0x0

Process Information:
	Process ID:	0x4

Access Request Information:
	Transaction ID:	{00000000-0000-0000-0000-000000000000}
	Accesses:	DELETE
				ReadAttributes
				
	Access Mask:	0x10080
	Privileges Used for Access Check:	-