WinRegMon Blacklist specific Registry Hive

[DanielAmlung]

Hi,

i currently use the WinRegMon Stanza within the inputs.conf. Currently i monitor all changes within the User Software Hive. But there is one Path that i want to exclude. So i tried using the blacklist feature, but it didnt work. See my config attached:

hive = \REGISTRY\USER\.\Software\\?.
blacklist1 = \REGISTRY\USER\.\Software\Classes\.\MuiCache\\?.*
proc=.*

That blacklist doesnt work - can someone spot the failure?

Thanks in advance

[spayneort · Accepted solution]

blacklist1 is for event logs, not registry monitoring. You could change your hive regex to exclude the unwanted path but include the others.