Audit the literal text Audit (case sensitive) Group audit_outcome(?P<audit_outcome>(Success|Failure)) Successthe literal text Success (case sensitive) Failurethe literal text Failure (case sensitive) ,the literal , (4410 / 548 / 2C16)
Group log_date(?P<log_date>.*) .*any character (except for line terminators), repeated any number of times
,Microsoft-Windows-Eventlog,the literal text ,Microsoft-Windows-Eventlog, (case sensitive) Group event_id(?P<event_id>\d+) \d+a digit, repeated at least once
,the literal , (4410 / 548 / 2C16)
Group category(?P<category>.*) .*any character (except for line terminators), repeated any number of times
,the literal , (4410 / 548 / 2C16)
Group event_message(?P<event_message>.*) .*any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Group amount_of_events(?P<amount_of_events>\d+) \d+a digit, repeated at least once
g modifier: global. Finds all matches instead of stopping after the first