<AUDT:INFO>the literal text <AUDT:INFO> (case sensitive) .any character (except for line terminators)
Group date(?<date>\d+.\d+.\d+) \d+a digit, repeated at least once
.any character (except for line terminators)
\d+a digit, repeated at least once
.any character (except for line terminators)
\d+a digit, repeated at least once
the literal (3210 / 408 / 2016)
Non-Capturing Group(?:\d+:\d+:\d+) \d+a digit, repeated at least once
:the literal : (5810 / 728 / 3A16)
\d+a digit, repeated at least once
:the literal : (5810 / 728 / 3A16)
\d+a digit, repeated at least once
the literal (3210 / 408 / 2016)
Non-Capturing Group(?:\d+.\d+.\d+.\d+) \d+a digit, repeated at least once
.any character (except for line terminators)
\d+a digit, repeated at least once
.any character (except for line terminators)
\d+a digit, repeated at least once
.any character (except for line terminators)
\d+a digit, repeated at least once
the literal (3210 / 408 / 2016)
Non-Capturing Group(?:.*(?<subject>Failed 'Active Directory' login attempt)(?:.\w+.\w+)(?<impacteduser>.*?'\W)) .*any character (except for line terminators), repeated any number of times
Group subject(?<subject>Failed 'Active Directory' login attempt) Failed 'Active Directory' login attemptthe literal text Failed 'Active Directory' login attempt (case sensitive) Non-Capturing Group(?:.\w+.\w+) .any character (except for line terminators)
\w+any word character, repeated at least once
.any character (except for line terminators)
\w+any word character, repeated at least once
Group impacteduser(?<impacteduser>.*?'\W) .*?any character (except for line terminators), repeated any number of times
'the literal ' (3910 / 478 / 2716)
\Wany non-word character
\w+any word character, repeated at least once
.any character (except for line terminators)
\w+any word character, repeated at least once
.any character (except for line terminators)
\w+any word character, repeated at least once
.any character (except for line terminators)
\w+any word character, repeated at least once
.any character (except for line terminators)
'the literal ' (3910 / 478 / 2716)
Group sip(?<sip>.\d+.\d+.\d+.\d+) .any character (except for line terminators)
\d+a digit, repeated at least once
.any character (except for line terminators)
\d+a digit, repeated at least once
.any character (except for line terminators)
\d+a digit, repeated at least once
.any character (except for line terminators)
\d+a digit, repeated at least once
'the literal ' (3910 / 478 / 2716)
g modifier: global. Finds all matches instead of stopping after the first
m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string