code: def _ExtractCronJobIdFromPath(entry, event):
    
    match = re.match(r".*cron-job/([^/]+).*", entry.http_request_path)
    if match:
      event.urn = "aff4:/cron/{}".format(match.group(1))
docs: Extracts a CronJob ID from an APIAuditEntry's HTTP request path.