registry‑raw Audit

Collects a list of Windows registry keys of host endpoints using raw methods that may bypass security and access restrictions.

This audit was formerly known as the w32registryraw audit.

Windows only

The following input parameters are available for this audit.

Details	Values	Description
Platform	Windows	Windows environments
Format	RegistryPath	Valid values are a registry key.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Specify the top-level registry that the audit should walk from. If this parameter is specified, it must include the hive name (such as HKLM).

Details	Values	Description
Platform	Windows	Windows environments
Format	String	Valid values are a string of text.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Specify the Perl-compatible regular expression a registry key or value name must match to be collected. The following example matches any registry key or value in any sub-key of the root: `` The following example matches any registry key or value named `Run` in any sub-key: `\\\\Run` The following example matches any registry key or value in a sub-key of `Services` (note that backslashes must be escaped: `*\\\\Services\\\\`

Details	Values	Description
Platform	Windows	Windows environments
Format	String	Valid values are a string of text.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Specify a Perl-compatible regular expression that a registry key or value must match to be collected (for example, `\"svchost(\\d\\d)?\\.exe\"`). REG_SZ values are automatically converted from UTF16 to UTF8 for comparison. All other values are compared as is.

Details	Values	Description
Platform	Windows	Windows environments
Format	String	Valid values are a string of text.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values	`"KeysOnly" "ValuesOnly" "All"`	Specify whether registry keys or values are collected. The default is `"All"`.

Details	Values	Description
Platform	Windows	Windows environments
Format	Numeric	Valid values are numeric.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Specify the number of levels the audit should read recursively in the tree of keys rooted at `root_key`. Specifying `-1` reads the entire tree. The starting depth is not relative to the hive.

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether to prevent the host endpoint from entering hibernation while this audit is executed.