Windows Registry Monitoring (im_regmon)
This module periodically scans the Windows registry and generates event records if a change in the monitored registry entries is detected.
This module is only available on Windows. |
To examine the supported platforms, see the list of installer packages in the Available Modules chapter. |
Configuration
The im_regmon module accepts the following directives in addition to the common module directives. The RegValue directive is required.
Required directives
The following directives are required for the module to start.
This mandatory directive specifies the name of the registry entry.
It must be a string type expression.
Wildcards are also supported.
See the File directive of im_file for more details on how wildcarded entries can be specified.
More than one occurrence of the RegValue directive can be specified.
The path of the registry entry specified with this directive must start with one of the following:
|
Optional directives
If set to TRUE, this boolean directive indicates that the 64-bit registry view should be monitored. The default is TRUE. |
|
This specifies the digest method (hash function) to be used to calculate the checksum.
The default is |
|
This directive specifies a single registry path or a set of registry values (using wildcards) to be excluded from the scan. More than one occurrence of the Exclude directive can be used. |
|
If set to TRUE, this boolean directive specifies that registry entries set with the RegValue directive should be scanned recursively under subkeys.
For example, |
|
This directive specifies how frequently, in seconds, the module will check the registry entry or entries for modifications.
The default is 86400 (1 day).
The value of ScanInterval can be set to |
Procedures
The following procedures are exported by im_regmon.
start_scan();
-
Trigger the Windows registry integrity scan. This procedure returns before the scan is finished.
Fields
The following fields are used by im_regmon.
$raw_event
(type: string)-
A list of event fields in key-value pairs.
$Digest
(type: string)-
The calculated digest (checksum) value.
$DigestName
(type: string)-
The name of the digest used to calculate the checksum value (for example,
SHA1
).
$EventTime
(type: datetime)-
The current time.
$EventType
(type: string)-
One of the following values:
CHANGE
orDELETE
.
$Hostname
(type: string)-
The name of the system where the event was generated.
$PrevDigest
(type: string)-
The calculated digest (checksum) value from the previous scan.
$PrevValueSize
(type: integer)-
The size of the registry entry’s value from the previous scan.
$RegistryValueName
(type: string)-
The name of the registry entry where the changes were detected.
$Severity
(type: string)-
The severity name:
WARNING
.
$SeverityValue
(type: integer)-
The WARNING severity level value:
3
.
$ValueSize
(type: integer)-
The size of the registry entry’s value after the modification.
Examples
This example monitors the registry entry recursively and scans every 10 seconds. Messages generated by any detected changes will be written to file in JSON format.
<Extension json>
Module xm_json
</Extension>
<Input regmon>
Module im_regmon
RegValue 'HKLM\Software\Policies\*'
ScanInterval 10
</Input>
<Output file>
Module om_file
File 'C:\test\regmon.log'
Exec to_json();
</Output>
<Route regmon_to_file>
Path regmon => file
</Route>
The im_regmon module provides a start_scan() procedure that can be called to invoke the scan. The following configuration will trigger the scan every day at midnight.
<Extension json>
Module xm_json
</Extension>
<Input regmon>
Module im_regmon
RegValue 'HKLM\Software\*'
Exclude 'HKLM\Software\Program Groups\*'
ScanInterval 0
<Schedule>
When @daily
Exec start_scan();
</Schedule>
</Input>
<Output file>
Module om_file
File 'C:\test\regmon.log'
Exec to_json();
</Output>
<Route dailycheck>
Path regmon => file
</Route>