#include <StringConstants.au3> ; to declare the Constants of StringRegExp
#include <Array.au3> ; UDF needed for _ArrayDisplay and _ArrayConcatenate
Local $sRegex = "CEF:(?<cef_cefVersion>\d+)\|(?<deviceVendor>[^|]*)\|(?<deviceProduct>[^|]*)\|(?<deviceVersion>[^|]*)\|(?<deviceEventClassId>[^|]*)\|(?<name>[^|]*)\|(?<severity>[^|]*)"
Local $sString = "CEF:0|NombreDeFabricante|NombreDeProducto|1.0|IdentificadorTipoEvento|NombreEvento|High| eventId=6642904107 type=2 mrt=1435653826633 sessionId=0 generatorID=qn7nr00BABCAAWmHK722fQ\=\= catdt=Sinkhole modelConfidence=0 severity=0 relevance=10 assetCriticality=0 priority=3 art=1435653847001 cat=Bot deviceSeverity=Warning act=Mevade rt=1435653777000 shost=HostOrigen src=IPOrigen sourceZoneID=MfdHjJR0BABCAT9DSiOoDxQ\=\= sourceZoneURI=/All Zones/ArcSight System/Public Address Space Zones/RIPE NCC/62.0.0.0-62.255.255.255 (RIPE NCC) sourceGeoCountryCode=ES sourceGeoLocationInfo=NombreCiudad slong=-3.xxx slat=43.xxx sourceGeoPostalCode=xxxxx sourceGeoRegionCode=xx dhost=HostDestino dst=IPDestino destinationZoneID=Mokee5CcBABCGKZ5Updd27g\=\= destinationZoneURI=/All Zones/ArcSight System/Public Address Space Zones/RIPE NCC/193.0.0.0-195.255.255.255 (RIPE NCC) dpt=80 destinationGeoCountryCode=PT destinationGeoLocationInfo=NombreCiudad dlong=-9.xxx dlat=38.xxx destinationGeoPostalCode=xxx destinationGeoRegionCode=xx fname=Conexiones maliciosas filePath=/Ruta al fname/Conexiones maliciosas fileType=Rule request=http://HostDestino/policy ruleThreadId=SeiiQ04BABD9xHYRcACZnw\=\= cs1=Unknown cs2=<Resource URI\="/xxxxxxxxxxx/Conexiones maliciosas" ID\="5ATikaUQBABDArjxMSXCuNQ\=\="/> cs6=CFYDHANP cn1=6739 flexNumber1=8 locality=1 cs1Label=Nombre ASN cs2Label=Configuration Resource ahost=xxxx.incibe.es agt=xxx.xxx.xxx.xxx av=5.1.2.5857.0 atz=Europe/Madrid aid=qn7nr00BABCAAWmHK722fQ\=\= at=superagent_ng dvchost=xxxx.incibe.es dvc=xxx.xxx.xxx.xxx deviceZoneID=Mbp432AABABCDUVpYAT3UdQ\=\= deviceZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 172.16.0.0-172.31.255.255 deviceZoneExternalID=RFC1918: 172.16.0.0-172.31.255.255 deviceAssetId=4W0dT8T4BABCAV5TwjQThbw\=\= dtz=Europe/Madrid deviceFacility=Rules Engine eventAnnotationStageUpdateTime=1435653827604 eventAnnotationModificationTime=1435653827604 eventAnnotationAuditTrail=1,1435635335503,root,Queued,,,,\n eventAnnotationVersion=1 eventAnnotationFlags=0 eventAnnotationEndTime=1435653777000 eventAnnotationManagerReceiptTime=1435653826633 _cefVer=0.1 ad.arcSightEventPath=3PUhT8T4BABCAYJTwjQThbw\=\= baseEventIds=6642903984" & @CRLF & _
"CEF:0|NombreDeFabricante|NombreDeProducto|1.0|IdentificadorTipoEvento|NombreEvento|High| eventId=6642904107 type=2 mrt=1435653826633 sessionId=0 generatorID=qn7nr00BABCAAWmHK722fQ\=\= catdt=Sinkhole modelConfidence=0 severity=0 relevance=10 assetCriticality=0 priority=3 art=1435653847001 cat=Bot deviceSeverity=Warning act=Mevade rt=1435653777000 shost=HostOrigen src=IPOrigen sourceZoneID=MfdHjJR0BABCAT9DSiOoDxQ\=\= sourceZoneURI=/All Zones/ArcSight System/Public Address Space Zones/RIPE NCC/62.0.0.0-62.255.255.255 (RIPE NCC) sourceGeoCountryCode=ES sourceGeoLocationInfo=NombreCiudad slong=-3.xxx slat=43.xxx sourceGeoPostalCode=xxxxx sourceGeoRegionCode=xx dhost=HostDestino dst=IPDestino destinationZoneID=Mokee5CcBABCGKZ5Updd27g\=\= destinationZoneURI=/All Zones/ArcSight System/Public Address Space Zones/RIPE NCC/193.0.0.0-195.255.255.255 (RIPE NCC) dpt=80 destinationGeoCountryCode=PT destinationGeoLocationInfo=NombreCiudad dlong=-9.xxx dlat=38.xxx destinationGeoPostalCode=xxx destinationGeoRegionCode=xx fname=Conexiones maliciosas filePath=/Ruta al fname/Conexiones maliciosas fileType=Rule request=http://HostDestino/policy ruleThreadId=SeiiQ04BABD9xHYRcACZnw\=\= cs1=Unknown cs2=<Resource URI\="/xxxxxxxxxxx/Conexiones maliciosas" ID\="5ATikaUQBABDArjxMSXCuNQ\=\="/> cs6=CFYDHANP cn1=6739 flexNumber1=8 locality=1 cs1Label=Nombre ASN cs2Label=Configuration Resource ahost=xxxx.incibe.es agt=xxx.xxx.xxx.xxx av=5.1.2.5857.0 atz=Europe/Madrid aid=qn7nr00BABCAAWmHK722fQ\=\= at=superagent_ng dvchost=xxxx.incibe.es dvc=xxx.xxx.xxx.xxx deviceZoneID=Mbp432AABABCDUVpYAT3UdQ\=\= deviceZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 172.16.0.0-172.31.255.255 deviceZoneExternalID=RFC1918: 172.16.0.0-172.31.255.255 deviceAssetId=4W0dT8T4BABCAV5TwjQThbw\=\= dtz=Europe/Madrid deviceFacility=Rules Engine eventAnnotationStageUpdateTime=1435653827604 eventAnnotationModificationTime=1435653827604 eventAnnotationAuditTrail=1,1435635335503,root,Queued,,,,\n eventAnnotationVersion=1 eventAnnotationFlags=0 eventAnnotationEndTime=1435653777000 eventAnnotationManagerReceiptTime=1435653826633 _cefVer=0.1 ad.arcSightEventPath=3PUhT8T4BABCAYJTwjQThbw\=\= baseEventIds=6642903984" & @CRLF & _
""
Local $aArray = StringRegExp($sString, $sRegex, $STR_REGEXPARRAYGLOBALFULLMATCH)
Local $aFullArray[0]
For $i = 0 To UBound($aArray) -1
_ArrayConcatenate($aFullArray, $aArray[$i])
Next
$aArray = $aFullArray
; Present the entire match result
_ArrayDisplay($aArray, "Result")
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for AutoIt, please visit: https://www.autoitscript.com/autoit3/docs/functions/StringRegExp.htm