regmon-filters.conf

regmon-filters.conf

The following are the spec and example files for regmon-filters.conf.

regmon-filters.conf.spec

# Copyright (C) 2005-2010 Splunk Inc.  All Rights Reserved.  Version 4.0 
#
# This file contains potential attribute/value pairs to use when configuring Windows registry
# monitoring. The regmon-filters.conf file is used in conjunction with sysmon.conf, and 
# contains the specific regular expressions you create to refine and filter the hive key paths 
# you want Splunk to monitor. You must restart Splunk to enable configurations. 
# 
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/Aboutconfigurationfiles

[<stanza name>
	* Name of the filter being defined.

proc = <string>
	* Regex specifying process image that you want Splunk to monitor.

hive = <string>
	* Regex specifying the registry key path that you want Splunk to monitor.

type = <string>
	* Regex specifying the type(s) of registry event that you want Splunk to monitor. 
        This must be a subset of those defined for the event_types attribute in regmon-filters.conf.

baseline = <int 0|1>
	* Whether or not to establish a baseline value for the keys this filter defines. 

baseline_interval = <int>
	* The threshold, in seconds, for how long Spunk has to have been down before re-taking the 
          snapshot. 

disabled = <int 0|1>
	* Disables or enables a given filter.

regmon-filters.conf.example

# Copyright (C) 2005-2010 Splunk Inc.  All Rights Reserved.  Version 4.0 
#
# This file contains example registry monitor filters 
#
# To use one or more of these configurations, copy the configuration block into
# regmon-filters.conf in $SPLUNK_HOME/etc/search/local/. You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/Aboutconfigurationfiles


# The following are examples of registry monitor filters.  To create your own filter, modify 
# the values by following the spec outlined in regmon-filters.conf.spec.

[default]
disabled = 1
baseline = 0
baseline_interval = 86400

[User keys]
proc = \\Device\\.*
hive = \\REGISTRY\\USER\\.*
type = set|create|delete|rename

• Was this topic useful?
• Post a comment