Example for Windows 2008 WinSecurity events:
[dropevents]
REGEX = (?msi)^EventCode=(4776|4648|4624|4634).*^Keywords=Audit\sSuccess
DEST_KEY = queue
FORMAT = nullQueue
You can also use the following site to verify the regex:
http://gskinner.com/RegExr/?31r9a
... View more