hi
i try to query a registry key but Nothing is displayed
index="" sourcetype=WinRegistry key_path="\REGISTRY\USER\.\Software\WOW6432Node\Master\ConfigurationCountry\.*
could you bring me help please?
IN INPUT/
[WinRegMon://hkcu_run1]
disabled = 0
hive = \REGISTRY\USER\.\Software\WOW6432Node\Master\ConfigurationCountry\.
proc = .*
type = set|create|delete|rename
index = windows
thanks
it works until :
index="" sourcetype="winregistry" key_path="\registry\user
but after un have an error message:
⚠ Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk. See search.log for more information.
Could you please share the search.log information
BUTut i got results Index="windows" sourcetype=WinRegistry
After getting above data can you select the key_path from selected fields? Also can you try to find out Event Code 4657 ?
This doc may help:
https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/5a3187b4419202f0fb8b2dd1/151319544...
hI loglognathan Nothing is also displayed....
Could you please try this query
index="windows" sourcetype=WinRegistry disabled = 0 type=set OR type=create OR type=delete OR type=rename key_path="\REGISTRY\USER.\Software\WOW6432Node\Master\ConfigurationCountry.*
hi
now i use this request but Nothing is displayed.
index="" sourcetype=WinRegistry disabled = 0 type=set OR type=create OR type=delete OR type=rename key_path="\REGISTRY\USER.\Software\WOW6432Node\Airbus\Master\ConfigurationCountry."
an idea please?
Could you please try only this query
ndex="windows" sourcetype=WinRegistry disabled = 0 type=set OR type=create OR type=delete OR type=rename
Could you please provide the SS of Index="windows" sourcetype=WinRegistry
or please provide the result sample