Getting Data In
Highlighted

Configuring Windows Registry

New Member

I am having trouble extracting certain information from registry events. For example I want to extract the "SetValue" from the registry type, however, when I try to use the "extract fields" option to create to create a field for it, Splunk does not allow me to select that specific string to create the field. Is there a way to fix this? Or an alternative method to create fields for registrytype and also keypath and process_image?

eventstatus="(0)The operation completed successfully."
pid=7008
process
image="svchost.exe"
registrytype="SetValue"
key
path="HKU\s-1-5-20\software\microsoft\windows\currentversion\deliveryoptimization\config\downloadmodebackcompat"
data
type="REG_DWORD"
data="0x00000001(1)"

0 Karma
Highlighted

Re: Configuring Windows Registry

SplunkTrust
SplunkTrust

are you using the Splunk TA for Windows?
did you follow this doc:
https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/MonitorWindowsregistrydata
I see all the fields extracted, screenshot below

alt text

View solution in original post

0 Karma
Highlighted

Re: Configuring Windows Registry

New Member

Hi Adonio I am using the TA for Windows and I also followed the doc, however my events still do not look like the ones you have in the screen shot. This is the monitor I am using, not sure if it aligns with the one you are using.

[WinRegMon://hklm_run]
disabled = 0
hive = \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.*
proc = .*
index = windows
type = rename|set|create|delete|rename

Also, do you think I need to make any changes or configs to any other file? In order to get all the other events to come in properly?

0 Karma
Highlighted

Re: Configuring Windows Registry

New Member

I also had an asterisk at the end of hive in proc, not sure why it didnt come up.

0 Karma