Getting Data In

Configuring a Win Universal Forwarder to monitor Win Registry Events

aaronnicoli
Path Finder

Hi all,

I am currently needing to provide our mid-range team with some config to begin monitoring windows registry data on a Win03 box running Splunk Universal Forwarder.
The problem is this, I have pretty much zero knowledge on the Win specific stuff, I only deal in the linux space.

So, after trawling the net I have come up empty on the "exact" required changes to Splunk .conf files in order to enable windows registry monitoring.
We currently have the forwarder installed and monitoring Windows events which is working successfully.

Is anyone able to give me some example config to monitor Windows registry events?
Thing I would most be interested in is the additions required to inputs.conf

Any help would be very very appreciated.

Thanks,
Aaron.

0 Karma
1 Solution

aaronnicoli
Path Finder

Worked it out eventually...

Added this to inputs.conf

[script://$SPLUNK_HOME\bin\scripts\splunk-regmon.path]
disabled = 0
interval = 10000000
source = WinRegistry 
sourcetype=WinRegistry
queue = winparsing
persistentQueueSize=50MB

And created install_path/etc/system/local/regmon-filters.conf, with this:

[RegistryMonitor]
baseline = 0
disabled = 0
hive = HKEY_LOCAL_MACHINE\\?.*
index = system
proc = C:\\.*
type = rename|close|set|delete|open|create|query

Worked.

View solution in original post

aaronnicoli
Path Finder

Worked it out eventually...

Added this to inputs.conf

[script://$SPLUNK_HOME\bin\scripts\splunk-regmon.path]
disabled = 0
interval = 10000000
source = WinRegistry 
sourcetype=WinRegistry
queue = winparsing
persistentQueueSize=50MB

And created install_path/etc/system/local/regmon-filters.conf, with this:

[RegistryMonitor]
baseline = 0
disabled = 0
hive = HKEY_LOCAL_MACHINE\\?.*
index = system
proc = C:\\.*
type = rename|close|set|delete|open|create|query

Worked.

SplunkUser5888
Path Finder

You just saved my life 😜

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...