Can someone confirm they are monitoring some keys under here?
I am trying to monitor the USB & USBSTOR keys for any changes (new USB keys plugged in) but it does not send it back to the aggregator. I am monitoring some software keys and they report just fine but the USB's do not....
Thanks.
Kevin
OK, though my Splunk case a formal bug has been submitted.
Found it in the web interface under a different heading. Set it up in the web as well, still not passing data.
OK, so when I click through the registry monitory in the web interface, I get to HKLM\System\CurrentControlSet\Enum & there is nothing there? There should be a whole bunch of stuff but the only key there is PCI? Where is USBSTOR & USB?
Any thoughts? Thanks!