topic Can HKLM\SYSTEM be monitored with Registry Monitoring in Getting Data In

Can HKLM\SYSTEM be monitored with Registry Monitoring

kholleran — Thu, 15 Nov 2012 16:17:20 GMT

Can someone confirm they are monitoring some keys under here?

I am trying to monitor the USB & USBSTOR keys for any changes (new USB keys plugged in) but it does not send it back to the aggregator. I am monitoring some software keys and they report just fine but the USB's do not....

Thanks.

Kevin

Re: Can HKLM\SYSTEM be monitored with Registry Monitoring

kholleran — Thu, 15 Nov 2012 16:29:00 GMT

OK, so when I click through the registry monitory in the web interface, I get to HKLM\System\CurrentControlSet\Enum & there is nothing there? There should be a whole bunch of stuff but the only key there is PCI? Where is USBSTOR & USB?

Any thoughts? Thanks!

Re: Can HKLM\SYSTEM be monitored with Registry Monitoring

kholleran — Fri, 16 Nov 2012 00:04:04 GMT

Found it in the web interface under a different heading. Set it up in the web as well, still not passing data.

Re: Can HKLM\SYSTEM be monitored with Registry Monitoring

kholleran — Mon, 26 Nov 2012 03:07:18 GMT

OK, though my Splunk case a formal bug has been submitted.