sysmon.conf

sysmon.conf

sysmon.conf.spec

# Copyright (C) 2005-2008 Splunk Inc.  All Rights Reserved.  Version 3.0 
#
# This file contains possible attribute/value pairs for configuring registry monitoring
# on a Windows system, including global settings for which event types (adds, deletes, renames, 
# and so on) to monitor, which regular expression filters from the regmon-filters.conf file to use, 
# and whether or not Windows registry events are monitored at all.
# This file is used in conjunction with regmon-filters.conf.
# You must restart Splunk to enable configurations. 
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/HowDoConfigurationFilesWork.
[<stanza name>]
        * Defaults to [RegistryMonitor]
        * Follow this stanza name with the following attribute/value pairs
event_types = <string>
        * Regex string specifying the type of events to monitor. Can be delete, set, create, rename, open, close, query.
active_filters = <string>
        * Double quoted strings of filter names (defined in regmon-filters.conf) to use.
disabled = <1 or 0>
        * 1 to disable, 0 to enable. 

sysmon.conf.example

# Copyright (C) 2005-2008 Splunk Inc.  All Rights Reserved.  Version 3.0 
#
# This file contains an example configuration for monitoring changes
# to the Windows registry. Refer to sysmon.conf.spec for details.
# The following is an example of a registry monitor filter.  To create your own filters, modify 
# the values using the information in regmon-filters.conf.spec.
#
# To use one or more of these configurations, copy the configuration block into
# sysmon-filters.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/HowDoConfigurationFilesWork.
[RegistryMonitor]
event_types = set.*|create.*|delete.*|rename.*
active_filters = "reg-filter-1"
disabled = 0

• Was this topic useful?
• Post a comment