How I can enable monitoring of USBSTOR in Splunk Web?

[m130carbine]

I am wanting to go into the Splunk Web and monitor the USBSTOR in Windows 10.  I am selecting the "New Registry Monitoring, then when I browse to the hive or key I want to monitor (USBSTOR) it isn't listed as a choice.  It resides at Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR.  The value that I am interested in is the "Start" value changes.   Can someone point me to how I can enable monitoring of this in Splunk Web?

Thanks,

Marty

[ringoshimaki]

Anyone?

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR.  I want to monitor when the Start value changes from a 3 or 4 and what machine, user, etc that made the change.  I am working on the Splunk_TA_Windows and go to the inputs.conf file and put in the input but I am not sure if that is the correct place or why it doesn’t report the change in search in Splunk.  It does create an event code in Windows for the change so I think it is a matter of getting the input worded correctly or something.