Monitoring Splunk

Does WinRegMon requires the Windows Remote Registry service?

merdenoms
Loves-to-Learn Everything

I want to keep the Windows Remote Registry service turned off on my Windows machines.  I decided to use Splunk to monitor the service and see if anything turns it on.  It turns out that Splunk is actually turning on and off the service throughout the day.  This is probably because I'm using WinRegMon to monitor the registry.

 

Does Splunk actually require the Remote Registry service?  Or is this something I can disable?  I was wondering why Splunk turns the service on for remote use when the Splunk forwarder is installed locally on the Windows machine.

 

Here is an example of what I have in my inputs.conf:

 

 

[WinRegMon://RegistryMonitor]
baseline = 0
disabled = 0
hive = HKEY_USERS\\.*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\.*
proc = C:\\.*
type = rename|close|set|delete|open|create|query

 

 

Labels (1)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!