On Thu, Nov 7, 2013 at 12:59 AM, BP9906 <[email protected]> wrote: > I take it all back. Sorry. > I didnt wait for a definition update. I ran another syscheck on the same box > as earlier and it showed up again. :( > > <registry_ignore > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NAVEX15</registry_ignore> > <registry_ignore > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NAVENG</registry_ignore> > > 2013 Nov 06 21:21:53,4 - > HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NAVENG > 2013 Nov 06 21:21:53,4 - > HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NAVEX15 > > What do you suggest now? >
Since you're not using any simple regex, try those entries without the type being specified. Other than that, I imagine tracking down the issue in the code is your best bet. I don't have any Windows systems to test with, and I've never gotten the Windows compilation to work. Oh, and you can open a ticket in the bitbucket https://bitbucket.org/jbcheng/ossec-hids > On Wednesday, November 6, 2013 4:47:59 PM UTC-8, BP9906 wrote: >> >> It appears a copy paste into ossec.conf on the local agent is successful. >> I cannot get any feedback from those regkeys using ./bin/syscheck_control -r >> -i <id> >> So what do I do now? >> >> On Tuesday, November 5, 2013 8:32:40 AM UTC-8, dan (ddpbsd) wrote: >>> >>> On Mon, Nov 4, 2013 at 4:31 PM, BP9906 <[email protected]> wrote: >>> > I'm trying to exclude Symantec registry keys from being checked because >>> > they >>> > change with every definition change. >>> > >>> > Any idea why this isnt working? I tried with and without sregex and >>> > using >>> > the carrot "^" in front and nothing seems to take. >>> > I'm not using profiles, I just have a blanket <agent_config >>> > os="Windows"> >>> > >>> >>> Does it work if you put it in the ossec.conf? >>> >>> > Thank you for your help and/or suggestions to try. >>> > >>> > <registry_ignore >>> > >>> > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\IDSxpx86</registry_ignore> >>> > <registry_ignore >>> > >>> > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BHDrvx64</registry_ignore> >>> > <registry_ignore >>> > >>> > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BHDrvx86</registry_ignore> >>> > <registry_ignore >>> > >>> > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NAVEX15</registry_ignore> >>> > <registry_ignore >>> > >>> > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NAVENG</registry_ignore> >>> > <registry_ignore >>> > >>> > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\IDSVia64</registry_ignore> >>> > <registry_ignore >>> > >>> > type="sregex">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ccSettings_</registry_ignore> >>> > >>> > >>> > -- >>> > >>> > --- >>> > You received this message because you are subscribed to the Google >>> > Groups >>> > "ossec-list" group. >>> > To unsubscribe from this group and stop receiving emails from it, send >>> > an >>> > email to [email protected]. >>> > For more options, visit https://groups.google.com/groups/opt_out. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
