import Foundation
let pattern = #"(EventCode=(4624|4634|4625)\X*Account Name:(\s+.*\.adm.*))|(EventCode=(4659|4663|5145)\X*Object Name:(\s+.*Test_share.*))"#
let regex = try! NSRegularExpression(pattern: pattern, options: .anchorsMatchLines)
let testString = #"""
05/03/2024 02:46:06 PM
LogName=Security
EventCode=4624
EventType=0
ComputerName=myhost
SourceName=Microsoft Windows security auditing.
Type=Information
RecordNumber=0
Keywords=Audit Success
TaskCategory=Logon
OpCode=Info
Message=An account was successfully logged on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Information:
Logon Type: 3
Restricted Admin Mode: -
Virtual Account: No
Elevated Token: Yes
Impersonation Level: Delegation
New Logon:
Security ID: DOMAIN\user.adm
Account Name: user.adm
Account Domain: DOMAIN.LOCAL
Logon ID: 0
Linked Logon ID: 0x0
Network Account Name: -
Network Account Domain: -
Logon GUID: {}
Process Information:
Process ID: 0x0
Process Name: -
Network Information:
Workstation Name: -
Source Network Address:
Source Port: 63095
Detailed Authentication Information:
Logon Process: Kerberos
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
04/30/2024 04:49:05 PM
LogName=Security
EventCode=4659
EventType=0
ComputerName=MyHost
SourceName=Microsoft Windows security auditing.
Type=Information
RecordNumber=0
Keywords=Audit Success
TaskCategory=File System
OpCode=Info
Message=A handle to an object was requested with intent to delete.
Subject:
Security ID: myuser
Account Name: myuser
Account Domain: Domain
Logon ID: 0x580B3D59
Object:
Object Server: Security
Object Type: File
Object Name: D:\Test_share\prova.txt
Handle ID: 0x0
Process Information:
Process ID: 0x4
Access Request Information:
Transaction ID: {00000000-0000-0000-0000-000000000000}
Accesses: DELETE
ReadAttributes
Access Mask: 0x10080
Privileges Used for Access Check: -
"""#
let stringRange = NSRange(location: 0, length: testString.utf16.count)
let matches = regex.matches(in: testString, range: stringRange)
var result: [[String]] = []
for match in matches {
var groups: [String] = []
for rangeIndex in 1 ..< match.numberOfRanges {
let nsRange = match.range(at: rangeIndex)
guard !NSEqualRanges(nsRange, NSMakeRange(NSNotFound, 0)) else { continue }
let string = (testString as NSString).substring(with: nsRange)
groups.append(string)
}
if !groups.isEmpty {
result.append(groups)
}
}
print(result)
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Swift 5.2, please visit: https://developer.apple.com/documentation/foundation/nsregularexpression