Audit the literal text Audit (case sensitive) Group audit_outcome(?P<audit_outcome>Success|Failure) Successthe literal text Success (case sensitive) Failurethe literal text Failure (case sensitive) ,the literal , (4410 / 548 / 2C16)
Group log_date(?P<log_date>.*) .*any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Group log_time(?P<log_time>.*) .*any character (except for line terminators), repeated any number of times
,Microsoft-Windows-Security-Auditing,the literal text ,Microsoft-Windows-Security-Auditing, (case sensitive) Group event_id(?P<event_id>\d+) \d+a digit, repeated at least once
,the literal , (4410 / 548 / 2C16)
Group category(?P<category>.*) .*any character (except for line terminators), repeated any number of times
,the literal , (4410 / 548 / 2C16)
Group event_message(?P<event_message>.*) .*any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Subject:the literal text Subject: (case sensitive) \s+any whitespace character, repeated at least once
Security ID:the literal text Security ID: (case sensitive) \s+any whitespace character, repeated at least once
Group subject_security_id(?P<subject_security_id>.*) .*any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Account Name:the literal text Account Name: (case sensitive) \s+any whitespace character, repeated at least once
Group subject_account_name(?P<subject_account_name>.*) .*any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Account Domain:the literal text Account Domain: (case sensitive) \s+any whitespace character, repeated at least once
Group subject_account_domain(?P<subject_account_domain>.*) .*any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Logon ID:the literal text Logon ID: (case sensitive) \s+any whitespace character, repeated at least once
Group subject_logon_id(?P<subject_logon_id>.*) .*any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Process Information:the literal text Process Information: (case sensitive) \s+any whitespace character, repeated at least once
Process ID:the literal text Process ID: (case sensitive) \s+any whitespace character, repeated at least once
Group PI_process_id(?P<PI_process_id>.*) .*any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Name:the literal text Name: (case sensitive) \s+any whitespace character, repeated at least once
Group PI_name(?P<PI_name>.*) .*any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Previous Time:the literal text Previous Time: (case sensitive) \s+any whitespace character, repeated at least once
Group previous_time(?P<previous_time>.*) .*any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
New Time:the literal text New Time: (case sensitive) \s+any whitespace character, repeated at least once
Group new_time(?P<new_time>.*) .*any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Group audit_message(?P<audit_message>.*) .*any character (except for line terminators), repeated any number of times
g modifier: global. Finds all matches instead of stopping after the first