APM windows inspector

I'm building a policy out in my lab with the following workflow

 

User -> APM Policy -> Windows Inspector -> Grab logged in user and domain -> if domain is valid -> queryAD for the email address -> SAML insertion ....

 

So far I was able to get the windows inspector agent to install and when utilizing the messagebox to determine what the values it uses for session.windows_info_os.last.user is in the following format |user|DOMAIN\user|

 

I'm trying to determine the best way I can assign variables to both the user value and the domain value and came across doing so in regex. Would someone be able to provide some input on how to do this or an efficient way to parse this info?

 

Thanks