Registry Value

reg_value

The registry value object describes a Windows registry value.

Attributes

Caption	Name	Type	Description
Data	`data`	JSON	The data of the registry value. Where the value type is known, implementers should instead use a type-specific attribute, i.e. reg_binary_data, reg_integer_data, reg_string_data, or reg_string_list_data.
Default Value	`is_default`	Boolean	The indication of whether the value is from a default value name. For example, the value name could be missing.
System	`is_system`	Boolean	The indication of whether the object is part of the operating system.
Modified Time	`modified_time`	Timestamp	The time when the registry value was last modified.
Name	`name`	String	Entity:`REGISTRY_VALUE_OBJECT_NAME` The name of the registry value.
Path	`path`	Registry Key Path	Entity:`REGISTRY_KEY_PATH` The full path to the registry key, where the value is located.
Raw Data	`raw_data`	JSON	Group:`context` The event data as received from the event source.
Record ID	`record_id`	String	Group:`primary` Unique identifier for the object
Registry Binary Data	`reg_binary_data`	Byte String	The data of the registry value when type_id is REG_BINARY or REG_NONE.
Registry Integer Data	`reg_integer_data`	Long	The data of the registry value when type_id is REG_DWORD, REG_DWORD_BIG_ENDIAN, or REG_QWORD.
Registry String Data	`reg_string_data`	String	The data of the registry value when type_id is REG_SZ, REG_EXPAND_SZ, or REG_LINK.
Registry String List Data	`reg_string_list_data`	String[]	The data of the registry value when type_id is REG_MULTI_SZ.
Type	`type`	String	A string representation of the value type as specified in Registry Value Types.
Type ID	`type_id`	Integer	The value type ID. `1`: REG_BINARY (`REG_BINARY`) `2`: REG_DWORD (`REG_DWORD`) `3`: REG_DWORD_BIG_ENDIAN (`REG_DWORD_BIG_ENDIAN`) `4`: REG_EXPAND_SZ (`REG_EXPAND_SZ`) `5`: REG_LINK (`REG_LINK`) `6`: REG_MULTI_SZ (`REG_MULTI_SZ`) `7`: REG_NONE (`REG_NONE`) `8`: REG_QWORD (`REG_QWORD`) `9`: REG_QWORD_LITTLE_ENDIAN (`REG_QWORD_LITTLE_ENDIAN`) `10`: REG_SZ (`REG_SZ`) `0`: Unknown (`UNKNOWN`) `99`: Other (`OTHER`)
Unmapped	`unmapped`	Unmapped[]	Data from the source that was not mapped into the schema.

Relationships

Inbound Relationships

These objects and events reference Registry Value in their attributes:

Outbound Relationships

Registry Value references the following objects and events in its attributes:

Unmapped

This page describes qdm-1.5.1+ocsf-1.6.0

Updated 4 months ago

Did this page help you?