extract auditd type=TYPE using regex to allow optional preceeding fields
extract auditd type=TYPE using regex to allow optional preceeding fields

Signed-off-by: kylemvz <85e3d43a669293812bd7569435b4d92086e60bc4@lab41.org>

d-grossman/magichour,d-grossman/magichour,d-grossman/magichour,d-grossman/magichour,d-grossman/magichour