Hello,
I am trying to monitor the registry of remote forwarders. I have the following in my regmon.conf
[default]
disabled = 0
baseline = 0
#30 days
#baseline_interval = 2592000
# Monitor all registry keys under the HKEY_CURRENT_USER Registry hive for
# "set," "create," "delete," and "rename" events created by all processes.
# Store the events in the "regmon" splunk index
[USBSTOR]
proc = .*
hive = \REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR
type = set|create|delete|rename
index = default
baseline = 0
disabled = 0
[USB]
proc = .*
hive = \REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Enum\USB
type = set|create|delete|rename
index = default
baseline = 0
disabled = 0
I am trying to monitor when a USB device is plugged in. I am using deployment server to deploy this as an app, I see it show up in deployment-client, & I see the keys showing in the reg input on the forwarder... I then walk to the device, plug in a USB flash drive, watch the registry change, but no events ever show up!
Can anyone see anything I am doing wrong?
Thanks for your help.
Kevin
I realize this post is old, but do you recall what the index line should read or reference to? Thanks in advance for any help.
AHHHHH!!!! Fixed... the index line was incorrect as that is not the index I want it going to so that was messing it up.
Someone help!!!! I need to get this to work by tomorrow morning!!! I cannot understand why this is not working!!!
Has anyone done anything like this? I want to alert when a new USB device is plugged in....
Thanks.
I am thinking I need to double-slash to escape. Did this & now I have no errors, but made a change in the registry and nothing is coming across....
I see the following in Splunkd.log:
splunk-regmon - WinRegistryMonitor::configure: Failed to get configuration settings: 'Regex: PCRE does not support \L, \l, \N{name}, \U, or \u'