registry‑api Audit

Published on Sep 10, 2026

2 minute(s) read

Article summary

Collects a list of Windows registry keys of host endpoints using standard API methods.

This audit was formerly known as the w32registryapi audit.

Supported Platforms

Windows only

Input Parameters

The following input parameters are available for this audit.

Path

Details	Values	Description
Platform	Windows	Windows environments
Format	RegistryPath	Valid values are a registry key.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Specify the top-level registry that the audit should walk from. If this parameter is specified, it must include the hive name (such as HKLM).

Path Regex

Details	Values	Description
Platform	Windows	Windows environments
Format	String	Valid values are a string of text.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Specify the Perl-compatible regular expression a registry key or value name must match to be collected. The following example matches any registry key or value in any sub-key of the root: `` The following example matches any registry key or value named `Run` in any sub-key: `\\\\Run` The following example matches any registry key or value in a sub-key of `Services` (note that backslashes must be escaped: `*\\\\Services\\\\`

Value Regex

Details	Values	Description
Platform	Windows	Windows environments
Format	String	Valid values are a string of text.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Specify a Perl-compatible regular expression that a registry key or value must match to be collected (for example, `\"svchost(\\d\\d)?\\.exe\"`). REG_SZ values are automatically converted from UTF16 to UTF8 for comparison. All other values are compared as is.

Type

Details	Values	Description
Platform	Windows	Windows environments
Format	String	Valid values are a string of text.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values	`"KeysOnly" "ValuesOnly" "All"`	Specify whether registry keys or values are collected. The default is `"All"`.

Depth

Details	Values	Description
Platform	Windows	Windows environments
Format	Numeric	Valid values are numeric.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Specify the number of levels the audit should read recursively in the tree of keys rooted at `root_key`. Specifying `-1` reads the entire tree. The starting depth is not relative to the hive.

Prevent Hibernation

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether to prevent the host endpoint from entering hibernation while this audit is executed.

:

Was this article helpful?