Getting Data In
Highlighted

WinRegMon Blacklist specific Registry Hive

Engager

Hi,

i currently use the WinRegMon Stanza within the inputs.conf. Currently i monitor all changes within the User Software Hive. But there is one Path that i want to exclude. So i tried using the blacklist feature, but it didnt work. See my config attached:

hive = \REGISTRY\USER\.\Software\\?.
blacklist1 = \REGISTRY\USER\.\Software\Classes\.\MuiCache\\?.*
proc=.*

That blacklist doesnt work - can someone spot the failure?

Thanks in advance

0 Karma
Highlighted

Re: WinRegMon Blacklist specific Registry Hive

Contributor

blacklist1 is for event logs, not registry monitoring. You could change your hive regex to exclude the unwanted path but include the others.

View solution in original post