Group event_message(?P<event_message>A user account was locked out\.) A user account was locked outthe literal text A user account was locked out (case sensitive) \.the literal . (4610 / 568 / 2E16)
\s+any whitespace character, repeated at least once
Subject:the literal text Subject: (case sensitive) \s+any whitespace character, repeated at least once
Security ID:the literal text Security ID: (case sensitive) \s+any whitespace character, repeated at least once
Group subject_security_id(?P<subject_security_id>.*?) .*?any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Account Name:the literal text Account Name: (case sensitive) \s+any whitespace character, repeated at least once
Group subject_account_name(?P<subject_account_name>.*?) .*?any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Account Domain:the literal text Account Domain: (case sensitive) \s+any whitespace character, repeated at least once
Group subject_account_domain(?P<subject_account_domain>.*?) .*?any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Logon ID:the literal text Logon ID: (case sensitive) \s+any whitespace character, repeated at least once
Group subject_logon_id(?P<subject_logon_id>.*?) .*?any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Account That Was Locked Out:the literal text Account That Was Locked Out: (case sensitive) \s+any whitespace character, repeated at least once
Security ID:the literal text Security ID: (case sensitive) \s+any whitespace character, repeated at least once
Group locked_out_security_id(?P<locked_out_security_id>.*?) .*?any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Account Name:the literal text Account Name: (case sensitive) \s+any whitespace character, repeated at least once
Group locked_out_account_name(?P<locked_out_account_name>.*?) .*?any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Additional Information:the literal text Additional Information: (case sensitive) \s+any whitespace character, repeated at least once
Caller Computer Name:the literal text Caller Computer Name: (case sensitive) \s+any whitespace character, repeated at least once
Group add_info_caller_computer_name(?P<add_info_caller_computer_name>.*) .*any character (except for line terminators), repeated any number of times
g modifier: global. Finds all matches instead of stopping after the first