I take it all back. Sorry.
I didnt wait for a definition update. I ran another syscheck on the same
box as earlier and it showed up again. :(
<registry_ignore
type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NAVEX15</registry_ignore>
<registry_ignore
type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NAVENG</registry_ignore>
2013 Nov 06 21:21:53,4 -
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NAVENG
2013 Nov 06 21:21:53,4 -
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NAVEX15
What do you suggest now?
On Wednesday, November 6, 2013 4:47:59 PM UTC-8, BP9906 wrote:
>
> It appears a copy paste into ossec.conf on the local agent is successful.
> I cannot get any feedback from those regkeys using ./bin/syscheck_control
> -r -i <id>
> So what do I do now?
>
> On Tuesday, November 5, 2013 8:32:40 AM UTC-8, dan (ddpbsd) wrote:
>>
>> On Mon, Nov 4, 2013 at 4:31 PM, BP9906 <[email protected]> wrote:
>> > I'm trying to exclude Symantec registry keys from being checked because
>> they
>> > change with every definition change.
>> >
>> > Any idea why this isnt working? I tried with and without sregex and
>> using
>> > the carrot "^" in front and nothing seems to take.
>> > I'm not using profiles, I just have a blanket <agent_config
>> os="Windows">
>> >
>>
>> Does it work if you put it in the ossec.conf?
>>
>> > Thank you for your help and/or suggestions to try.
>> >
>> > <registry_ignore
>> >
>> type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\IDSxpx86</registry_ignore>
>>
>>
>> > <registry_ignore
>> >
>> type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BHDrvx64</registry_ignore>
>>
>>
>> > <registry_ignore
>> >
>> type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BHDrvx86</registry_ignore>
>>
>>
>> > <registry_ignore
>> >
>> type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NAVEX15</registry_ignore>
>>
>>
>> > <registry_ignore
>> >
>> type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NAVENG</registry_ignore>
>>
>>
>> > <registry_ignore
>> >
>> type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\IDSVia64</registry_ignore>
>>
>>
>> > <registry_ignore
>> >
>> type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ccSettings_</registry_ignore>
>>
>>
>> >
>> >
>> > --
>> >
>> > ---
>> > You received this message because you are subscribed to the Google
>> Groups
>> > "ossec-list" group.
>> > To unsubscribe from this group and stop receiving emails from it, send
>> an
>> > email to [email protected].
>> > For more options, visit https://groups.google.com/groups/opt_out.
>>
>
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
