Regex Editor & Tester

Parses Windows Security Event ID 4625 ('An account failed to log on') messages, extracting fields such as subject account, logon type, failure reason, status/sub-status codes, caller process info, source network address and port, and authentication package details into named capture groups. Notably, it hardcodes the failed account name as 'Administrator', targeting failed logon attempts against the built-in Administrator account. Ideal for SIEM ingestion, security monitoring, and detecting brute-force or credential-based attacks.