https://live.paloaltonetworks.com/t5/general-topics/how-to-search-the-registry-entries-in-cortex-xdr/m-p/577024#M115812 <P>How can i search the&nbsp;<SPAN>Registry entries in cortex XDR in the query builder&nbsp;</SPAN></P> <P><SPAN>Sample registry</SPAN></P> <P>HKCU\Software\Microsoft\Windows\CurrentVersion</P> Mon, 12 Feb 2024 13:13:53 GMT Nitin_Yadav 2024-02-12T13:13:53Z https://live.paloaltonetworks.com/t5/general-topics/how-to-search-the-registry-entries-in-cortex-xdr/m-p/577024#M115812 <P>How can i search the&nbsp;<SPAN>Registry entries in cortex XDR in the query builder&nbsp;</SPAN></P> <P><SPAN>Sample registry</SPAN></P> <P>HKCU\Software\Microsoft\Windows\CurrentVersion</P> Mon, 12 Feb 2024 13:13:53 GMT https://live.paloaltonetworks.com/t5/general-topics/how-to-search-the-registry-entries-in-cortex-xdr/m-p/577024#M115812 Nitin_Yadav 2024-02-12T13:13:53Z https://live.paloaltonetworks.com/t5/general-topics/how-to-search-the-registry-entries-in-cortex-xdr/m-p/577031#M115815 <P>You will create a query builder with similar information&nbsp;</P> <P>dataset = xdr_data <BR />|filter event_type = ENUM.REGISTRY <BR />|filter action_registry_key_name = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\*" <BR />|fields causality_actor_process_image_path, actor_process_image_path, agent_hostname, action_registry_key_name, action_registry_value_name, action_registry_data <BR />|dedup causality_actor_process_image_path, actor_process_image_path, agent_hostname, action_registry_key_name, action_registry_value_name, action_registry_data</P> Mon, 12 Feb 2024 15:28:07 GMT https://live.paloaltonetworks.com/t5/general-topics/how-to-search-the-registry-entries-in-cortex-xdr/m-p/577031#M115815 Alejandro_Hernandez 2024-02-12T15:28:07Z