help with building a regular expression for automation rule

Question

Can anybody help me with the following.
We receive alerts from Microsoft defender from different customers.
The problem is that in some alerts the organization name is not provided so we don't know from which customer or client the alert is coming from.
According to this article ( Parse issues )you should be able to build a regular expression so we can extract the to string with the e-mail (alias) the mail has been send to.
I'm no developer and have limited scripting experience. 
In the raw data from the email you can find this info:

is it possible to extract the email address behind to, and then use that information to set a label?

Thx in advance

Stefan Voogt · Answer

Hi Jeroen,

Thx that is working :)
Next issue :)
currently i have this rule:

I'm using aliases to send mails to jira.
in this rule even when i change (route443) to (something) in defender and send a mail to jira,  the label field is still populated. 
Basically wat I need is only when the To address matches the first part of the e-mail (before the @) then the label field needs to be filled.

Next phase is then how can i put this in one rule using multiple addresses and multiple labels.
so 
Client1 > Label client1
Client2 > Label client2
etc.

Jeroen Poismans · Answer

Hi Stefan,

I can help you with the regex:

To:\s*([^]+)

This should match everything after "To:" (group 1). Have a look at this regex tester site:
https://regex101.com/

To validate you can paste your raw data in the TEST STRING box, for example:

From: sender@example.com
To: email@domain.com
Subject: Your subject here
Date: Date and Time

In the REGULAR EXPRESSION box you can test the regex above. In the MATCH INFORMATION box to the right it will show you the result.

Hope this helps!

Jeroen