import re


def _extract_timestamp(audit_str: str) -> str:
    """
    Parse an auditd message string and extract the message time.

    Parameters
    ----------
    audit_str : str
        The Audit message

    Returns
    -------
    str
        The extracted message time string

    """
    audit_message = audit_str.rstrip().split(": ")
    audit_headers = audit_message[0]
    audit_hdr_match = re.match(r".*msg=audit\(([^\)]+)\)", audit_headers)
    if audit_hdr_match:
        return audit_hdr_match.group(1).split(":")[0]
    return ""