Regex Editor & Tester

Parses syslog-formatted Indicator of Attack (IoA) alert messages emitted by Tenable Identity Exposure (formerly Tenable.ad). Captures named groups for the syslog priority code, timestamp, instance hostname, product name, internal message type and alert ID, AD forest/domain, attack name, severity level, source and destination hostnames and IPs, plus trailing insertion strings. Handles messages wrapped in curly/smart quotes, and with global/multiline flags processes multiple log lines at once.