Registry Event

Event Buffer Attribute	Helix Field Destination	Notes
`eventType`	`event_values.eventType`	The type of the registry access as one of the following: 0: Other key/value change 1: Value change 2: Value deleted 3: Key created 4: Key deleted 5: Key renamed
`hive`	`event_values.hive`	The name of the hive being accessed
`keypath`	`event_values.keypath`	The path of the key being accessed (not including the hive)
`path`	`regpath`	The full path of the key being accessed
`pid`	`pid`	The process ID accessing the registry
`ppath`	`event_values.ppath`
`process`	`process`	The name of the process accessing the registry
`processPath`	`processPath`	The path for the PE of the process accessing the registry
`text`	`event_values.text`	The data associated with the key, formatted as text
`username`	`username`	The owner of the process accessing the registry
`value`	`regvalue`	The data for the value associated with the key; little-endian base-64 encoded. Available on create/update.
`valueName`	`regkey`	The name of the value associated with the key. Available on create/update.
`valueType`	`event_values.valueType`	The Windows registry value type that was created/updated
`valueTypeRaw`	`event_values.valueTypeRaw`