regex101: PCRE2 (PHP) Match Workspace

Group 2(EventCode(?:\S+)5156)

EventCodethe literal text EventCode (case sensitive)

Non-Capturing Group(?:\S+)

\S+any non-whitespace character, repeated at least once

5156the literal text 5156

Character Class[\s\S]*

*matches any number of characters from the set below:

\sany whitespace character

\Sany non-whitespace character

1st Alternative((((?:Source Address|Destination Address)(?:\S+))(?:\s)+10\.))

Group 4((((?:Source Address|Destination Address)(?:\S+))(?:\s)+10\.))

Group 5(((?:Source Address|Destination Address)(?:\S+))(?:\s)+10\.)

Group 6((?:Source Address|Destination Address)(?:\S+))

Non-Capturing Group(?:Source Address|Destination Address)

1st AlternativeSource Address

Source Addressthe literal text Source Address (case sensitive)

2nd AlternativeDestination Address

Destination Addressthe literal text Destination Address (case sensitive)

Non-Capturing Group(?:\S+)

\S+any non-whitespace character, repeated at least once

Non-Capturing Group(?:\s)+

+repeats the group contents below at least once:

\sany whitespace character

10the literal text 10

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

2nd Alternative(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.1[6-9])

Group 7(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.1[6-9])

Group 8((?:Source Address|Destination Address)(?:\S+))

Non-Capturing Group(?:Source Address|Destination Address)

1st AlternativeSource Address

Source Addressthe literal text Source Address (case sensitive)

2nd AlternativeDestination Address

Destination Addressthe literal text Destination Address (case sensitive)

Non-Capturing Group(?:\S+)

\S+any non-whitespace character, repeated at least once

Non-Capturing Group(?:\s)+

+repeats the group contents below at least once:

\sany whitespace character

172the literal text 172

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

1the literal 1 (49₁₀ / 61₈ / 31₁₆)

Character Class[6-9]

6-9one character from 6 (54₁₀) to 9 (57₁₀)

3rd Alternative(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.2[0-9])

Group 9(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.2[0-9])

Group 10((?:Source Address|Destination Address)(?:\S+))

Non-Capturing Group(?:\s)+

172the literal text 172

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

2the literal 2 (50₁₀ / 62₈ / 32₁₆)

Character Class[0-9]

4th Alternative(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.3[0-1])

5th Alternative(((?:Source Address|Destination Address)(?:\S+))(?:\s)+127\.0\.0\.1)

6th Alternative(((?:Source Address|Destination Address)(?:\S+))(?:\s)+192\.168)

Character Class[\s\S]*

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Search reference

Regular Expression

((EventCode(?:\S+)5156)[\s\S]*(((((?:Source Address|Destination Address)(?:\S+))(?:\s)+10\.))|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.1[6-9])|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.2[0-9])|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.3[0-1])|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+127\.0\.0\.1)|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+192\.168))[\s\S]*((((?:Source Address|Destination Address)(?:\S+))(?:\s)+10\.)|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.1[6-9])|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.2[0-9])|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.3[0-1])|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+127\.0\.0\.1)|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+192\.168)))

New

10/21/2021 10:06:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5156
EventType=0
Type=Information
ComputerName= (REDACTED BY ME THE POSTER)
TaskCategory=Filtering Platform Connection
OpCode=Info
RecordNumber=7865970185
Keywords=Audit Success
Message=The Windows Filtering Platform has permitted a connection.

Application Information:
	Process ID:		1548
	Application Name:	\device\harddiskvolume4\windows\system32\dns.exe

Network Information:
	Direction:		Inbound
Source Address:                 10.10.211.7
	Source Port:		53
Destination Address:            10.1.0.0
	Destination Port:       57834
	Protocol:		17

Filter Information:
	Filter Run-Time ID:	90427
	Layer Name:		Receive/Accept
	Layer Run-Time ID:	44

Regular Expressions 101

Regular Expression

Extraction