https://community.splunk.com/t5/Splunk-Enterprise-Security/Remote-Registry-Key-modifications/m-p/408521#M4773 <P>It currently monitors filesystem changes and to make adjustments to that I modify an inputs.conf file under deployment_apps. I want to add windows registry monitoring. I don't understand what is registry path in search "*datamodel=Endpoint.Registry where Registry.registry_path="\\*" *". When I remote modify with REGEDIT and monitor with <A href="https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon" target="_blank">Sysmon</A>, its does not return any path like that.<BR /> Thanks,</P> Wed, 30 Sep 2020 01:28:20 GMT vietlq414 2020-09-30T01:28:20Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Remote-Registry-Key-modifications/m-p/408521#M4773 <P>It currently monitors filesystem changes and to make adjustments to that I modify an inputs.conf file under deployment_apps. I want to add windows registry monitoring. I don't understand what is registry path in search "*datamodel=Endpoint.Registry where Registry.registry_path="\\*" *". When I remote modify with REGEDIT and monitor with <A href="https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon" target="_blank">Sysmon</A>, its does not return any path like that.<BR /> Thanks,</P> Wed, 30 Sep 2020 01:28:20 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Remote-Registry-Key-modifications/m-p/408521#M4773 vietlq414 2020-09-30T01:28:20Z