Hi Team,
The following inputs.conf works on localhost to monitor a registry key, but not working on the universal forwarder.
[WinRegMon://HKLM]
baseline=1
disabled=0
hive=\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\LanManServer\\Shares\\?.*
index=windows
proc=.*
type=set|create|delete|rename
BTW even the following hive attribute too works fine on local host but not on universal forwarder
hive=HKEY_LOCAL_MACHINE\\SYSTEM\\*ControlSet*\\Services\\LanManServer\\Shares\\?.*
But the default configuraiton of inputs.conf works on both local host and the universal forwarder.
[WinRegMon://default]
disabled = 0
hive = .*
proc = .*
type = rename|set|delete|create
index = windows
Any references are much helpful.
