I'm having a heck of a time getting some <registry_ignore> statements to work.
Here's sample statements from my agent.conf <windows_registry>HKEY_LOCAL_MACHINE\System\CurrentControlSet \Services</windows_registry> <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services \SharedAccess\Epoch2</registry_ignore> <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services \SharedAccess\Epoch2</registry_ignore> <registry_ignore type="sregex">Enum$|Epoch$|Epoch2$|^HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\ASP</registry_ignore> from the queue/syscheck folder: <checksums...> !1297719341 HKEY_LOCAL_MACHINE\System\CurrentControlSet \Services\SharedAccess\Epoch <checksums...> !1297719341 HKEY_LOCAL_MACHINE\System\CurrentControlSet \Services\SharedAccess\Epoch2 <checksums...> !1297723464 HKEY_LOCAL_MACHINE\System\CurrentControlSet \Services\ASP.NET_2.0.50727\Names <checksums...> !1297798072 HKEY_LOCAL_MACHINE\System\CurrentControlSet \Services\ASP.NET_4.0.30319\Names In the same config file, this registry_ignore statement seems to be working... <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services \PolicyAgent\Parameters\Cache</registry_ignore> I know I could write ignore rules to prevent e-mail alerts on change, but there's quite a few similar entries that i'm having problems with, and I'd prefer to not have to have them be scanned every syscheck. Thanks, Mike
