How to Search the Registry entries in cortex XDR

[Nitin_Yadav]

How can i search the Registry entries in cortex XDR in the query builder 

Sample registry

HKCU\Software\Microsoft\Windows\CurrentVersion

[Alejandro_Hernandez]

You will create a query builder with similar information 

dataset = xdr_data
|filter event_type = ENUM.REGISTRY
|filter action_registry_key_name = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\*"
|fields causality_actor_process_image_path, actor_process_image_path, agent_hostname, action_registry_key_name, action_registry_value_name, action_registry_data
|dedup causality_actor_process_image_path, actor_process_image_path, agent_hostname, action_registry_key_name, action_registry_value_name, action_registry_data