Hi,
I am trying to monitor Windows servers BIOS versions using Registry monitoring with UF. For testing, I installed a full Splunk Ent. and used a web GUI to add some Registry input with the baseline.
I received several events, but the _time field for the baseline event is weird. Approximately, they are in 3 days late. The create/etc. events look good.
_raw _time
09/21/2018 21:59:09.175 event_status="(0)The operation completed successfully." pid=16872 process_image="c:\Windows\regedit.exe" registry_type="DeleteKey" key_path="HKLM\hardware\description\system\bios\új azonosító (#1)" data_type="REG_NONE" data="" 2018-09-21 21:59:09
09/21/2018 21:59:09.175 event_status="(0)The operation completed successfully." pid=16872 process_image="c:\Windows\regedit.exe" registry_type="SetValue" key_path="HKLM\hardware\description\system\bios\test_key" data_type="REG_SZ" data="" 2018-09-21 21:59:09
09/21/2018 21:59:04.570 event_status="(0)The operation completed successfully." pid=16872 process_image="c:\Windows\regedit.exe" registry_type="SetValue" key_path="HKLM\hardware\description\system\bios\új azonosító (#1)" data_type="REG_SZ" data="" 2018-09-21 21:59:04
09/18/2018 10:47:04.786 registry_type="baseline" key_path="\registry\machine\hardware\description\system\bios\SystemVersion" data_type="REG_SZ" data="" 2018-09-18 10:47:04
09/18/2018 10:47:04.786 registry_type="baseline" key_path="\registry\machine\hardware\description\system\bios\SystemVersion" data_type="REG_SZ" data="" 2018-09-18 10:47:04
09/18/2018 10:47:04.786 registry_type="baseline" key_path="\registry\machine\hardware\description\system\bios\SystemVersion" data_type="REG_SZ" data="" 2018-09-18 10:47:04
The upper events are the create/update/etc events created within a few minutes with the baseline events, but baseline shows 18. Sept, update events 21 Sept. (today).
How it is possible, what am I doing wrong? The base system is a Win 10, and the system time is ok.
Inputs:
[WinRegMon://kulcsi01]
baseline = 1
disabled = 0
hive = HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\SYSTEM\\BIOS\\?.*
proc = C:\\.*
type = set|rename|create|delete
[WinRegMon://kulcsi02]
baseline = 1
disabled = 0
hive = HKEY_LOCAL_MACHINE\\SYSTEM\\HardwareConfig\\Current\\?.*
proc = C:\\.*
type = create
Thx,
István
↧