Getting Data In

Monitoring specific keys in the registry

Path Finder

I had the default registry monitoring turned on for our desktops for a day but it used way too much of our license so I had to disable it.

I am interested in monitoring a few keys but I am unclear on how to fill out the hive portion within the inputs.conf file.

Example of the keys I might monitor:

  1. REGISTRY: Watch for the creation or modification of new registry keys and values a. 4657 – Accesses: WriteData (or AddFile) i. HKLM, HKCU & HKU – Software\Microsoft\Windows\CurrentVersion
  2. Run, RunOnce ii. HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows
  3. Watch AppInit_Dlls iii. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt
  4. Watch Connection time of USB Devices iv. HKLM\System\CurrentControlSet\Services
  5. Watch for NEW Services v. HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR
  6. Watch for NEW USB devices
0 Karma


Here are a few examples that I run. For HKCU, you have to use this format:

disabled = 0
hive = \\REGISTRY\\USER\\.*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\.*
proc = .*
type = set|create|delete|rename
index = windows

For HKLM you use MACHINE:

disabled = 0
hive = \\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\.*
proc = .*
type = set|create|delete|rename
index = windows

You don't need to add stanzas for HKU, because your HKCU stanzas will suffice.



Can you advise how you can monitor multiple Reg Keys in the same stanza ?

Thank you

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...