Regex Editor & Tester
Build, test, and debug regular expressions
Build, test, and debug regular expressions
This PCRE regex parses Symantec Endpoint Protection agent activity log entries for LogRhythm SIEM ingestion. It captures named fields including optional Site (vendorinfo), Server Name (dname), and Domain Name (group), followed by mandatory reason, server name (sname), login, and domain values separated by commas. Used with global and multiline flags, it extracts structured identity and event context from SEP log lines for security monitoring and correlation.