On Mon, Nov 4, 2013 at 4:31 PM, BP9906 <[email protected]> wrote: > I'm trying to exclude Symantec registry keys from being checked because they > change with every definition change. > > Any idea why this isnt working? I tried with and without sregex and using > the carrot "^" in front and nothing seems to take. > I'm not using profiles, I just have a blanket <agent_config os="Windows"> >
Does it work if you put it in the ossec.conf? > Thank you for your help and/or suggestions to try. > > <registry_ignore > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\IDSxpx86</registry_ignore> > <registry_ignore > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BHDrvx64</registry_ignore> > <registry_ignore > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BHDrvx86</registry_ignore> > <registry_ignore > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NAVEX15</registry_ignore> > <registry_ignore > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NAVENG</registry_ignore> > <registry_ignore > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\IDSVia64</registry_ignore> > <registry_ignore > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ccSettings_</registry_ignore> > > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
