Ambiguities regarding registry-key object

[3c7]

From the description of the registry-key object, it's not really clear, what kind of information to put where. The object states in the description, that it includes a key and a value, however, registry data needs three things:

• key (the path, e.g. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run)
• value (the value set, in this case, e.g. Windows Update Host)
• data (the data itself, in this case a path to a file, e.g. C:\Users\User\AppData\Roaming\Microsoft\Update\Host.exe)

The object templates just defines key, data and a data-type (but not value). Probably the value is seen as part of the key here, but this is not mentioned in the description and in the typical microsoft terminology there is a difference between key and value.

As a JSON representation the difference would be like this:

MISP registry-key object

{
  "key": "data"
}

MS registry terminology

{
  "key": {
    "value": "data"
  }
}

Going to add a PR which changes the description of key, but wanted to create this issue for a potential discussion first.

[3c7]

Or is name the equivalent to value?