name: Get Process Registry Activity
id: d8362a34-b78a-4364-9733-59b505f5b8d5
version: 2
date: '2019-11-06'
description: This search returns the registry activity for a specific process on a
  specific endpoint
how_to_implement: To successfully implement this search you must be ingesting endpoint
  data and populating the Endpoint data model.
author: David Dorsey, Splunk
inputs:
- process_id
- dest
search: '| tstats `security_content_summariesonly` values(Registry.registry_key_name)
  as registry_key_name, values(Registry.dest) as dest, values(Registry.process_id)
  as process_id from datamodel=Endpoint.Registry where Registry.process_id=$process_id$
  AND Registry.dest=$dest$ by Registry.registry_path, Registry.action, _time | `drop_dm_object_name(Registry)`
  | sort _time | table _time, process_id, dest, action, registry_key_name, registry_path'
tags:
  analytics_story:
  - DHS Report TA18-074A
  - Suspicious Zoom Child Processes