Regex Group, problems with catching IPs

With your shown samples, please try following regex. This will create 3 capturing groups which will have values in them to grab later on.

^\[\S+\s+(\d{1,2}\.\d{2}\.\d{4})\s+(?:\d{2}:){2}\d{2}\s+SMTP\s+Server:\s*(?:\S+\s*\()?((?:\d+\.){3}\d+)\)?\s+[\w.-]+\s+(\d+).*$

Online demo for above regex

Explanation: Adding detailed explanation for above.

^\[\S+\s+                ##Matching from starting [ 1 or more non-space occurrence(s) followed by 1 or more occurrences of spaces.
(\d{1,2}\.\d{2}\.\d{4})  ##Creating 1st capturing group which matches 1 to 2 digits followed by DOT followed by 2 digits followed by dot followed by 4 digits.
\s+(?:\d{2}:){2}\d{2}    ##Matching 1 or more occurrences of spaces, then matching (2 digits colon)'s 2 occurrences followed by 2 digits here.
\s+SMTP\s+Server:\s*     ##Matching 1 or more spaces followed by SMTP 1 or more spaces followed by Server: spaces.
(?:\S+\s*\()?            ##In a non-capturing group matching 1 or more non-spaces followed by 0 or more spaces match ( keeping it optional.
((?:\d+\.){3}\d+)\)?     ##Creating 2nd capturing group which has digits in it.
\s+[\w.-]+\s+            ##Matching spaces \w.- 1 or more occurrences followed by spaces.
(\d+)                    ##Creating 3rd capturing group which has digits in it.
.*$                      ##Matching anything till end of value.

Change .* to .*? (or, given that that you can expect least one character to occur between the capture groups, .+?) to make the subexpression non-greedy.

That way, .* doesn't "steal" up to two leading digits from the what the following \d{1,3}subexpression matches.

To give a simple example:

# !! BROKEN: greedy.
PS> if (' 123' -match '.*(\d{1,3})') { $Matches[1] }

3 # !! Only the LAST digit matched, because .* matched as much as it
  # !! could while still matching \d{1,3}

# OK: non-greedy.
PS> if (' 123' -match '.*?(\d{1,3})') { $Matches[1] }

123 # OK - all 3 digits matched, because .*? matched as little as it
    # could while still matching \d{1,3}

To put it all together (note that I'm using .+?, also in lieu of .. before disconnected):

'[16A4:000C-0780] 01.12.2020 01:00:07   SMTP Server: 11.132.8.61 disconnected. 1 message[s] received',
'[12CC:0015-118C] 30.11.2020 05:08:59   SMTP Server: bsicip01.dd.example.com (12.99.81.53) disconnected. 1 message[s] received' |
  ForEach-Object {
    if ($_ -match '(\d{2}\.\d{2}\.\d{4} \d{2}:\d{2}:\d{2}).+?(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}).+?disconnected\.?\s+(\d+) message\[s\]') {
      [pscustomobject] @{
        Count = $Matches[3]
        Timestamp = $Matches[1]
        IP = $Matches[2]
      }
    }
  }

The above yields:

Count Timestamp           IP
----- ---------           --
1     01.12.2020 01:00:07 11.132.8.61
1     30.11.2020 05:08:59 12.99.81.53

Note:

• In general (it may not be necessary in your case), you could make the regex more robust by using word-boundary assertions, \b, around subexpressions such as .\d{1,3} so that they don't accidentally match inside longer runs of digits, or you could explicitly stipulate that a non-digit (\D) precede and follow.

Alternative solution using the -split operator:

As Lee Daley points out, you could use -split, the string splitting operator to split your lines into fields, as a conceptually simpler alternative to regexes:

'[16A4:000C-0780] 01.12.2020 01:00:07   SMTP Server: 11.132.8.61 disconnected. 1 message[s] received',
'[12CC:0015-118C] 30.11.2020 05:08:59   SMTP Server: bsicip01.dd.example.com (12.99.81.53) disconnected. 1 message[s] received' |
  ForEach-Object {
    $fields = -split $_
    if ($fields[-4] -eq 'disconnected.') {
      [pscustomobject] @{
        Count     = $fields[-3]
        Timestamp = '{0} {1}' -f $fields[1], $fields[2]
        IP        = $fields[-5].Trim('()')
      }
    }
  }

The above yields the same as the regex-based solution.