Splunk Enterprise Security

tag=registry

vijaysri
Builder

Hi,

I am forwarding sysmon logs to splunk, for normalization, I could see event ID : 12, 13, 14 are captured (Registry object added or deleted, Registry value added, Registry value modified)

All are success events, will there be any failure events under the above mentioned eventIDs?

Labels (2)
0 Karma
1 Solution

vijaysri
Builder

There wont be any failure events for endpoint datamodel  and tag=registry, tested it with the non-admin account.

Only success events (registry keys/values  - modified/renamed/created new, deleted) are captured under eventviewer

 

View solution in original post

0 Karma

vijaysri
Builder

There wont be any failure events for endpoint datamodel  and tag=registry, tested it with the non-admin account.

Only success events (registry keys/values  - modified/renamed/created new, deleted) are captured under eventviewer

 

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...