Can HKLM\SYSTEM be monitored with Registry Monitoring

[kholleran]

Can someone confirm they are monitoring some keys under here?

I am trying to monitor the USB & USBSTOR keys for any changes (new USB keys plugged in) but it does not send it back to the aggregator. I am monitoring some software keys and they report just fine but the USB's do not....

Thanks.

Kevin

[kholleran]

OK, though my Splunk case a formal bug has been submitted.

[kholleran]

Found it in the web interface under a different heading. Set it up in the web as well, still not passing data.

[kholleran]

OK, so when I click through the registry monitory in the web interface, I get to HKLM\System\CurrentControlSet\Enum & there is nothing there? There should be a whole bunch of stuff but the only key there is PCI? Where is USBSTOR & USB?

Any thoughts? Thanks!