Hi i have question regarding to monitoring registry entry with OSSEC (win agent).
For example: if i add new string value in registry under "HKLM\SOFTWARE \Micro..\..\Run" then i don't how to view or get alerts that registry was changed. The file integrity is working. I have made a printscreen: http://www.shrani.si/f/2J/y4/V6LuTT1/printscreen.jpg mdb5: a98402f3424440afebbb7e009ae99b97 sha1: 2ec11162e6a965d4724cfdad444bf841bfd3c861 thanks best regards dejan
