Splunk Enterprise Security

Remote Registry Key modifications

vietlq414
Explorer

It currently monitors filesystem changes and to make adjustments to that I modify an inputs.conf file under deployment_apps. I want to add windows registry monitoring. I don't understand what is registry path in search "*datamodel=Endpoint.Registry where Registry.registry_path="\\*" *". When I remote modify with REGEDIT and monitor with Sysmon, its does not return any path like that.
Thanks,

Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...