Skip to content

Commit

Permalink
Make registry key path and value name observables
Browse files Browse the repository at this point in the history
---------

Signed-off-by: Michal Dobisek <[email protected]>
  • Loading branch information
MiDoCisco committed Jan 31, 2025
1 parent d1e31e2 commit f9c5fed
Show file tree
Hide file tree
Showing 3 changed files with 19 additions and 3 deletions.
13 changes: 13 additions & 0 deletions extensions/windows/dictionary.json
Original file line number Diff line number Diff line change
Expand Up @@ -198,5 +198,18 @@
"description": "The Windows service.",
"type": "win_service"
}
},
"types": {
"caption": "Data Types",
"description": "The data types available in OCSF. Each data type specifies constraints in the form regular expressions, max lengths or value limits. Implementors of OCSF should ensure they abide to these constraints.",
"attributes": {
"reg_key_path_t": {
"observable": 43,
"caption": "Registry Key Path",
"description": "Full path of registry key.",
"type": "string_t",
"type_name": "String"
}
}
}
}
3 changes: 2 additions & 1 deletion extensions/windows/objects/registry_key.json
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,8 @@
"path": {
"caption": "Path",
"description": "The full path to the registry key.",
"requirement": "required"
"requirement": "required",
"type": "reg_key_path_t"
},
"security_descriptor": {
"caption": "Security Descriptor",
Expand Down
6 changes: 4 additions & 2 deletions extensions/windows/objects/registry_value.json
Original file line number Diff line number Diff line change
Expand Up @@ -21,11 +21,13 @@
},
"name": {
"description": "The name of the registry value.",
"requirement": "required"
"requirement": "required",
"observable": 44
},
"path": {
"description": "The full path to the registry key, where the value is located.",
"requirement": "required"
"requirement": "required",
"type": "reg_key_path_t"
},
"type": {
"description": "A string representation of the value type as specified in <a target='_blank' href='https://learn.microsoft.com/en-us/windows/win32/sysinfo/registry-value-types'>Registry Value Types</a>.",
Expand Down

0 comments on commit f9c5fed

Please sign in to comment.