Thank yo for your prompt reply. For example, let's take the Security log Event ID 4624 (An account was successfully logged on). To check if the logged in account is an intruder, the following fields are needed:

Subject: Account Name; Account Domain
Logon Information: Logon Type; Virtual Account; Elevated Token
New Logon: Account Name; Account Domain
Network Information: Workstation Name; Source Network Address

Some of these fields should be used in the matching regular expression to select just a subset of 4624 events, some are required for future event processing to make the final decision if it an intrusion, a suspicious activity, or a legitimate usage scenario.
I would argue that using a regular expression against well-structured XML is a much better way to extract all the information than processing formatted text of the message.

When you say that it could be possible to pass XML as a parameter of generated events, does it mean that there is a way to do that in the current implementation. If yes, how it can be done? It can be useful for in-depth analysis of some events.

Thank you,

Leo