It appears a copy paste into ossec.conf on the local agent is successful. I cannot get any feedback from those regkeys using ./bin/syscheck_control -r -i <id> So what do I do now?
On Tuesday, November 5, 2013 8:32:40 AM UTC-8, dan (ddpbsd) wrote: > > On Mon, Nov 4, 2013 at 4:31 PM, BP9906 <[email protected] <javascript:>> > wrote: > > I'm trying to exclude Symantec registry keys from being checked because > they > > change with every definition change. > > > > Any idea why this isnt working? I tried with and without sregex and > using > > the carrot "^" in front and nothing seems to take. > > I'm not using profiles, I just have a blanket <agent_config > os="Windows"> > > > > Does it work if you put it in the ossec.conf? > > > Thank you for your help and/or suggestions to try. > > > > <registry_ignore > > > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\IDSxpx86</registry_ignore> > > > > <registry_ignore > > > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BHDrvx64</registry_ignore> > > > > <registry_ignore > > > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BHDrvx86</registry_ignore> > > > > <registry_ignore > > > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NAVEX15</registry_ignore> > > > > <registry_ignore > > > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NAVENG</registry_ignore> > > > > <registry_ignore > > > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\IDSVia64</registry_ignore> > > > > <registry_ignore > > > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ccSettings_</registry_ignore> > > > > > > > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an > > email to [email protected] <javascript:>. > > For more options, visit https://groups.google.com/groups/opt_out. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
